| Category | Started On | Completed On | Duration | Cuckoo Version |
|---|---|---|---|---|
| FILE | 2016-11-03 00:31:45.938764 | 2016-11-03 00:33:59.660468 | 133 seconds | 2.0-dev |
| Machine | Label | Manager | Started On | Shutdown On |
|---|---|---|---|---|
| win-xp-sp3 | win-xp-sp3 | VirtualBox | 2016-11-03 00:31:46 | 2016-11-03 00:33:59 |
File Details
| File name | APT_ATT11990.pdf | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| File size | 438220 bytes | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| File type | PDF document, version 1.7 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CRC32 | BE9F717B | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| MD5 | 452703b9292a7a5d45eb224c622d32cf | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA1 | 2786d5ac6a4d5e378c0086acb7a8e19a79692cb2 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA256 | 796f0f938e60fc22189c6453db86d41b5cb0f2a84be0ff591584267b21af8dfd | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA512 | f6bd5fdbc07b3837cb5838203a63d3d00923bcdf7c42cdf3ff2038d403db5276c7a222c624f1c5a486e201ca1c0a52880f125adf220fae6f5d129647266365e9 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Ssdeep | 6144:TFBOyA3SpOYOlBvgxM0o5nA2+fIKpsMbq3PPW7Qk9gD/sg3LLTPQJhWZDw7BXJBU:/s/YOf6Ho5HcIIsMYKgTxf0iKxriOH0 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| PEiD | None matched | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Yara | None matched | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| VirusTotal |
Permalink VirusTotal Scan Date: 2014-11-09 14:48:41 Detection Rate: 37/54 (Expand)
|
Signatures
Screenshots
Static Analysis
Strings
%PDF-1.7
43 0 obj
<</Filter/FlateDecode/First 17/Length 168/N 3/Type/ObjStm>>stream
V^+8+#
endstream
endobj
44 0 obj
<</Filter/FlateDecode/First 11/Length 42/N 2/Type/ObjStm>>stream
24P0P04R0
endstream
endobj
45 0 obj
<</DecodeParms<</Columns 4/Predictor 12>>/Filter/FlateDecode/Index[0 1 7 1 9 2 12 2 45 1]/Length 35/Size 46/Type/XRef/W[1 2 1]>>stream
endstream
endobj
2 0 obj
<</Nums[0 3 0 R]>>
endobj
3 0 obj
<</S/D>>
endobj
4 0 obj
<</Count 1/Kids[17 0 R]/Type/Pages>>
endobj
64 0 obj<</Filter /FlateDecode>>stream
PdPD
LH
swakkvr)mqo
!"#$e&'()*+,-./0123456789:;<=>?@ABCDEFGH
&'8)*+
-./0133$567:9:;<;>>@GBBD@FFHIJK<MNNTQRS
\]^[@abcdefwxijklmnoparstuvwxyz{[
*+,+./0
23456789:;<=>?
j755+IJK<UOOP
RSTOWWXqZ[\]^_`abcdefg(ij+B
rs6pvwx
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
6789:;
hBCFoFGZcJKRgNO~{RSj
sZ[<w^_
[rsbXvwzTz{
&&()*+,-./x
}4567:9:;Z=>?
,8=%.+
4$65<.>..^_3
efg;09?) 2,
ibg#twiqamox,l.ie}~j4gssmw~zri>{AUC
WQIUINO
ECH]QBFAAVBBJ\
L4.0**"f&&-j9)9<&5';=348.x874)3*
Ihijk;
{>4*2
mnippr
)*+LMNGXY:;3MFGOIJ34=>7@IBDLEFGHIJK
MNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
HIH3IE
XW/(*)
'.$SQP
4.3$$p
@RGXX0\
KKL%MNPQ
=4BMKJ
0;O>>=
I@*:76
[R4$%$
SXPQRSl*]
( !"#<P
4K~c3C
7^7`abb
38:;H&
]\[lekdefg'R
KJI{tuvwC
[?>=<#
UUVW,j
N<`:BE
dcbRSlmn([
7;56701
L\]^_X
(+)('2
~*g,-d
gklmn6/.,(
aohijk
ywpqrs
$+wLNM
1<fGCB
*')*+$%&'
iB8X#]h
O!Bos=Ng
MNOHIJK
xyz{tuvw7
<=>?8~
lFGHIJK
VWJsZ[Bw^_NKbcZOfg8Cjk
pFCfTBI]O`ITo/
1q[U[QRk\HMU^[|//$*#w
5#$:70
66=6>\]
AqadrbN`fnM
Wtf_ufbRjkui
wSKWAcOKM)})`BMDbTA\AGUR89s9pR_[
$1,17%"HI
H $4*?7
6':#%;<Z[
USo}zIy}fvf
rzAE"#
!C_A]*+
-qNS\V_Z5
6gPTRHI[M-ACB
/3%9NO
'0""+<(6=)6:
Ag~n~aal{tvP{xfvj|_c
$aB\z^J^Y[_y_T\u5H5wLNKIIzZ"4%
<$=;2WnZ
iocwaUthklyx
WtfPagdrvmJis~{lS!y qKNFFMFNHhVLUAFZ[[p^TM_I<=
;2 ,'DEHB;;+%(MNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
_Y\Z^][Q:QZ[
jw+,-./0123456789:;<=>?@ABCDEFGHIJKLMNO
foHwYk1/E>
U|-@"F#a)`s)
A,GDLK
r<)>0=
pa\|T0!X{jF8;
MdR/=I8bc Oqw!8t'
}APG{P0g`
wj)MV.--k+2Ji,-
v^Z>.E
3210/.-,
!"#$
$g()*+,-./0
7s456789:;<
@ABCDEFG
LMNOPQRS
XYZ[\]^_D
p#defghij
x/pqrstuvW
e)@1+]
LMNOHI}
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
$%&'()*+,-./0133\567
<=>?@ABCDEFGHIKKHENO
VWXA[[\]^_`abcoe$g!i>k!m/o q-s2u?w4y?{1'
#defghijk<(no<pvsfW
9xyz{|}~
!"#$%&'()*+,-./0123|+67x9:;<=>?@ABCDUFGpKJKLMNOPQRSTUVWXYZ[\]^_`abcJ
noparstuwwx}z{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{
6+##
LGG>@KK*DOO
\WWjP[[vT__
lccNngghijk
foopqrsXywwxw{{|}~
")##
BGG>NKK,JOO
VSShRWWNQ[[xZ__hfcc.igg:ekk6aoo
4c/B=<@*<?;H5K:IT"%$i
(a*)0=}pNOG@P
ZQ3a$"-)##riz3i5`OPPPWQR^]SUJMKG^_P
gnmdh`(dgd
<u>=<1[}g5pvqu
EHFGOHX
]P./' 0ec#di&."*:'pt6}TUVW
#PSRTTUgX
]tuvw?
cesgaf
ppx~ns
kE!"#EFRN^L*+OB@IYV23]Q67LV:;SN>?2$2,61FG+!+%+(NO<>=# <;2XYZ[84-/
hnqwbljbfhgn
{}9|zuq0?
]&'N@FNY]B@QU23G]S[T9:;S[XS)/' )!FG< '.LMNOu5}vdg2x}ih?|xnm
fgqfp'<'8t
x&* }ypmj-#
Llag0!+!.&,," ( .=4w nus$}*
defgJijk
Bjtdm[ofc{k
.:+@*>/4VBS
HHHHHHHH
gmcdc`z%ht`k~b<|fr
3NQf!"#
ro3h567ZX^
]QRP# 6*++FG
=RCTUVW
7,:04:
56188:
{y
y{y !"#
Z X<=>?
;Z[2(23`abc
n`of$vcwi{k
.(*62vlestl|~
mhqkEE
LFOCD\
ZYC]K]DH
]AJ^_I[[@ABC%74&1i<* 8+o#4"2&4"8*y}w{};'
_ogt>%efdeeh,kof|tv
Z mag0IOFG
(#'))NO][w
[BcZ[fgVijkBCno}{WBD
!a)"8;n$)=<k04"!p/3'*}?*$y>:S!"#)/
{fghijklmnou"RSzUVW
w^_JabcK
cnonekb'nhcgii
S89:;X\JZ@ABC6(".:IJK>( .=4RS&08W52>2.]^_
+!"#@ zK[]_OEBr_B^XVWAEkKMI^NT[L
;!00&4")=%9
+#50!6
RZU8?%4<,
stuvwxyz{
16I\Mm
LMXXWA
;4567w
rdxj{<
#-./()m
h}m8p6
-./()m
<O8{tJ
;wh&}|{n
C\]^_ j
]\r$+*>d
!(,QON
*h8:9F$
+)(+|2
<R#T^N_
\_s#*)?b
WX1vO\M
hi38?>
NKEFG@A
NS]^_XYU[TUVW
%&' !e
4%J_p6
MJOP%O
[ 8vb_^
;2TDED
JM!743
`|}|l?
AnXSR#
4N~{zn
0;W=>=
R*VY5#
GMNM[#=
:;lU^+@Q
bgde50
kdefg'R
!rKd0&7
=>o()WCT
# %&p{
{^kl:]
NA!887
=N;'&2
spuv +
u3``_*
}3$H^O
Mv'5!2t
\[c#CVVU
MnAWVA
90RIGF
MD&=;:
rZ()zC
#"U/iT
/WX1zN\M
+n&987|
3l|nLE
z_*+|E
&*TOML90SIGF
AH*1/.
m rJs0%6p
DHI"kYM^
Hq6#4v
o^/0aZ3
pIB7$5q
F*+De;/
zA45f_
xyz{tuv0C
c(2n_^]
t@ML\J
2E-5<;
]T>$+*
$/_QRQ
7>QNA@
J^(698
@K;-.-
YP&+'&
T4J32%6
(YZ3\K^O
!(VQON
U\*'#"
y28xutd`
b+'Q^]Kr
MnsWV!m!
FJKDEF
'.QPQP;@
2&@@A@(
CJ,,-,
srJ#$%f
Gsev789:
)' !"#{
+R;<mmh
423bb\
T45f],
^VgTAR
JhjZYL
wH5"3t
49I_p7
L`_f'G
Ax3Clk
abc|}9L
9:;45q
wpqrsK>
:;456p
<56ngg
GXI2KD]N
$vecb5
=Q\\[(
%0rQON?
4?gBBA
MD2=;:
JM!443
9Nl+*f
.5MVTSk+WNNM
LG;::9
U\"%#"
ZT@RC2
Fa*@]]\[
:=@FDC
yE9><;
]T*/+*
wvuG@ABC
?6MKIH
2&DCA@(
CJ(/-,
u>x[qp
tuvwp6A
310[)Q,+
2Y2[\]
`abc|:M
L*XXW"
uvwpq5@
&*+$%&,
:;456p
$%&' !e
fjkdef
(9*Q<nh
kLPB9V
kKlpbrtuv
+9):bV=h
Ee^BTEFGH
`ca`_I
HGFExpqrs
!"#<=
456701
b_dofRhb
JH1J24
:;4567w
+&LXYX%
<3CEFE0
JA!;876
:;45670123
zRZwpqrsK>
YWPQRS+^
##%"CMNOHIJK
|y/-+.
'd/-,W
,-./()*+$%&'g
MFJKDEF
GH/sJ8I}
8c/SD1
kefg`a%P
j,qcs::=
9y>/ Y&*4%
"`):+T4:?
JuLENJpz
RP["Z\
h.n5l1b"`*
D-QPO2v
ee`sd"! /.
|>?CA@
S::9Nu
w!,&USRGf
$^U#!
IGF|>+CA@
OA2210
DxM976
@I]00/XW
llk} `gf
.3#VVUT)=PPOY
KKJ?2 GED
,oed Y
,=-TTSR+?NNM[
BIH1<"ECB
YfD#!
ppon jji
(1!XXWV/;RRQG
GML=0.IGF
9%@@?*
HAI8876GG221J
(('SWC""! e
%) 3$l
T)!PPOX
-TTSR#?NNM
MRL7543H^1/.:
f$ ][Z
M>8KIH
x:W?=<
L]M4432K_..-;
&)(Q\B%#"
$+7NNM81-HHGF?
(UU$$#
=XXWhL
;6,KIH3<"ECBA:
)ZT'%$
a_^)uL
&-)LLK<
-VD+)(S
%2b/! kd
;089:;4r
VZ[TUV
F ONM0
ENMLsr
ttuvwp6A
461$5pq~
g`kl.W
$+oMNM0L
MB8,-,+\c
%&%Rim# hW/
v Oyzyn
Rb_^K'
<=<M@.:76
S\:.+*)>
bfgTZ |
EBd,-,^P9*'&Wn
tB'pqNctuJ7
%(VZWV
D1EKHG
>M1?<;
BG#121L).
'&'`a^R
x`a`II
=N<010
\S?%&%`
\O%VVUl)ESPO
?2PDED7z
9@I%30/._;)*)R
m)ySPO
~<nFCB
1C%ojP
d)9c`_,'{YZY*
81eC@?>)
;p&:76AF(010]T
.+*><+&%
EPGHIy
kEU[TUVW
( !"#<z
:;<9J!
l~oLMNOHIy
@ABC\]m
&*+$%&`
& '6'onmlk
"P`#_)
bIG@ABC
0I8\4a
cono[4
P_*hpCb
+`; F
Xyz{U(
9Br9AA
',<=>?8~
B}b7HyO3@u@?HqC:S
*|;98K
?r&&%R
'%&M0q
QR5mV$Y
AFE0d0
380123
gfoml
qzvwpqr4?
=334@|
./0nim
g`abc;N
GFEwpqrsK>
'^%G,G
1L3Q>U
d2A#H#
()*+$b
%5&nfd
uvwpq5@
PQRSl*]
@<TTS(n
?89:;s
xyz{3F
"o021$
$%&' f
ikyz"%
0!X3^%
R7@{bs3
Iuhi32
!'&()*
+hUqstu
\, "#$c
AF3GNMZtKIH;
6+;567
ShYNOP
HUCOPQ
@}][\]
YzGKJ=
B(B[7->
;S;8NVG
="+<=>
n6.012
'}gghi
\8#"#$
k1"+,-
r*:456
y#6=>?
$@~Y(N
(tnnop
%&' !e
YZ[TUV
P,OT2*;
^=:Q,n
PQRSl*]
(YX]]_X
ae!@646
!"#<=y
1c1qo:98
"CB3:<
qB0v44
yJ&n,,
aR,f$$
7h9:M5k
tsDMC\]^_ j
i9B)R;ih
,E m]K\
R{,BA40J
56701u
L$>XW"'_RRQ,t
>1MHHG
+"QWUT
&2HOML\
\W+**)
edR=ihT=>?
x?>=8
l#"DOML
LG7::9
>?89:|
b ^YWV
EL2532
aPO8/3{JI>%!uDC5#G>>=+
@K{ .-
<!2K $&'x
==m\[-;
aPO9/GIJI_
CLML=(*xGF7>`rA@
<=!uDC4
Z]-'$#P
LG3<:9
h!(^WON
5<JkCB
_V$-)(
%^SPA:SPUV
=4COKJ
0$JGCBV
K>=NA=887J
WPQRS+^
C6g6]%?<;LC'565
2U$"!6#
MD:=;:
QV8 ! `]
hgf/saba
DTUT!(VQON9x]
HHGuvwpq5@
ohijk#V
M>AT:632
NA1;87
T_/!"!
#'(9*e
`"\TUT
>1LHHG
z8FA?>
%;;<jh
CG\^_<
81YJHG2
GN4310
+*[R '%$
99"$%zS:A
]\) ^YWV
&)YSPO
5<BECB
BU),,+
?'<->q
(#_VVU
LG;::9
+WNNM
Z]!$$#
DEF/KHJK
3:8?=<
76AN8310/
_V,+)(
) _YWV
$0VQONZ
OF<;98
YP.)'&
9:;45q
F,01e[
+WNNM
HG4?CBBA
T_#""!
-$Z][Z
TS +WNNM>
T_#""!
fg`ab$O
'.<{QP
x0'kjBA2}
<;nmlCL>
) VqWV
CN 610]l<(+*}|s
qVY1%
-#[SVU&)PUPO
JM5143
0970123
678Qz%<-m
<7zOJI
|>tFA@
=yPKCDCT
.ptu/.
GbIarqfm
WwTEV-y
Ed9apo
&' !"d
BX m]K\
=>?891
''7()*+<=/?0123
89:;0=>??-BSDEFGdYK[LMNO
TUVWTYZ[
'^O`abc
DCCDEFGHIJK
@RS<PWWXYZ[\]^_
icc`tfg
mkklmnopqrsh|wwxiz{
6??0JCC
@OOJZSST^WW
ww,s{{Bw
0123897789:;
]WW&Q[[*U__
mgg<akk$eooJyss^}wwXq{{
w~qn{k !
&WQTT\[*+
.qYC_BA][BQ89l8cNJM#,2*DE
C)=%"LM]J#% 0<'VW
]3(8496
jk`mQP@
:;-<;?
m`nokf
USo}zIy}fvf
Gptrhi{mM!#"{DKTOvOSEY./]BDPFA
9SZ-"2:DEWGwv{?5=+
tbiefdo
ONprp|y~v
A@PHMJJCI',*uYILJ/_0mU]YSYW9q9cQMZ%*+upE
>8"8(NO
:'4"#!Y
C`rSmdz[myfN
c}_swy
sDVeMICwG@D_I_./
1qAQTBR~PV^}=
C`rQm{ybccKwQ
Wgsvl|^rnx}kOS[b$%;%aG^N^AAL[TVvLV^VV^_;'?wQ4$0/+&-",
%&<,<*
)1;5;12XY$Y
EfpFsuzld
pxzZXBGSPLIIn@F_I_./
2aV@`X_YW^WYY{G#$27-*(
!%>.>M
1'%>77Z[
;{.-=-
[sudx{cexk
lkntpkF!| {VRUAJG[,-
/tT^V@Pp^T\{;<>mZ4
.$,JK&L
Kh~lLb`hO
@vyz`r\ph~
iqmY`"#
'vBMBdJAHJ
YAW3V5uE]XN^lOQ\%21
9?<*>%
:&05#7+#
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{
3210/.-,
<%&' )*+
-./O123456789:;<
@ABCDEFGH
LMNOPQRST
XYZ[\]^_
n#defghijk<
a/pqrstuvw\
}1X)35
YY[[TUVWPQe
3*;X7.?`+2#
#:+<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"# %"'*)*+,-./01234567B;:;==m?4A0C-E(G/I
K%M"O5Q
S:U0W7YZ[
_^_aaRcPeVgQiZkXm
o@qrs8u`wyy9{
H E!P#W%O'G)D+,-./
?nArCDEFGrIGKMM
O>Q&S1U$W6Y;[0]
p A!O#A%&'[)^+^-[/^1^3]5T7
9^;P=R?@ABCvEOGII
K>M!O4Q'S7U"W
Y;[1];_`abc
stuvwByq{}}.
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|m~
5 701S3
aj^w\DZRX(Vjkl]no
qrszEcGXINK7M&O
=R?Y9x;
BsG6A.C
;"=7?T!G#6$
0>2&,,._(I*e$
K~R|Xzjxzvst
ijkl]d_VAAC/D
M?W=Y;c9y7p5s3
p_q$sX|
iFfZ[\
^_4abc)U
TwM|OOI
-13315?759K;I=G?]!C#A%O'E){+y-w/^
pAqLs)}
_lPcRwT
6&4,:&8<>6<,"V \&F$L*F(|.
(9++l-./<
4r:p8v
Vfghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
m[j{hQV
DuMeOZARC
c[lSnShKj{TCVLPIR^\W^(X%Z"D(F
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
w/|-*3&'$%&'))**$-<3
lc/a~grsy{zz}}~|eip.TUV }
qlpjjD
d4_!65[<
h5v$lp
K'- 625-('A)#* 2;Xftev8:3PhkoT:
oWWHYJ
`m1025476
!5$+/0
+710C)
;RPW^
S6Pe`3
:^!`=IDF
(r]VwhU
(f:R_w
~lNU0(L
P:=Igz
":|qFW
H|(~8#
M(._{9
'Vd,I4
WrMSYGC
B4+Gxj
+N{#Ka*l
IaduP4}
_&wV5,S5
|`Jk;W
f*'ePv9m
d?H=w^
SJC%a;v
z';@ud
[?H7q6
4F aA
76(9*dng
pxsw{p
dLDLXE
qQUN^N
!&)#-CtuF>:=50?Y,
{G:eZ@IQ{
PS2.C~
qZj]NC
e~D+1[
v{2n0z
@X._C7O
tj1(Jt l
r.6-2z"df{K
ldocod
!'2#4zt}
B:/<->M
tz"LDOCOD%
$6cuevg
##:sl~
ctcvgx
l~h@QB1nJ UHQJ[L?d@6BRJTEV%rV<O\LJ_
{@CTEV
t|{oja
rM,./(
JA@CPo.
*bNlw1#
bUSRPQ@
ek?q>W:n-^)'
szs|psZ
rEVbuH54
MV4HeN>
ty"~L
,qUHHA&
NR{\U+|)
.Z'_0q
3O}9}4G
0Z])GZ
T(ua@x
>E,v;q
}SqaG2
A1Go\Y
O@>1#8',
WwlTz#s
`(%HU5
I-@5gW
RbCTe"jH
m50jA~
iqq)tE
KJ%zW-
j{P$IU"
p!`#U9
OjxE=pf
wRmsygc
tP%v3_
ZG1f<C
\ -{"TK'
-I\IgO7
iADUpT
X{%:].
f-R4*G
Ex50yBO
@8xCj8
\Pu] L
@%g:W o
bc=gc=
g\-NlJ
pxskmh~}p
zNEMAN/
>PXSW[P1
`. )Nyzh
,$,8%n}dqbs
15.>.r
:R2Cqx
Z*6 y.
eefy$"
{cF*Q@
i\s_jK;
bP K8;<0l
H+HMLc4?
^SF,5Z
G^8,ge3j
% &r0mH
DPg#{!V
fjauszlkf
&!6'8vxq
+GM@JDM"
H&*!)%"Cx}l}n 2;Xohz
PA0iK#
UVD*]NYPAR!~Z0FXNZK\/tP
+Icio}b+?<.?0C
-* ecj|{v
${vqpa`?
^\IfnT
mCj^OQ
qDDCC@O
^bC@NG
vz `-F-
bibca`K
-o*F(T
CvgUD{
ch1oCnz
?F'zzRu
@fyGP5
%u>S.SL
_CE;_a
_AjCD8m>
K>;"|.
aobO;I
<^n(j%T
'YzpSi
+cX:0~
lD`rV-
=)4&ke
^_/"2/6?
DfsEi2d
[j1_pf
r$#{Vo
xf`:eZ
S%|>rI
ZY4mF>
fE|`hh
KP u-L
.v!.g%
ShudzB
Ji&!nS\
W4t+H1|
r0M/9Ba
!fnl P
)AKBT\[OJA'KAT^PY>
vvrI!+"(*#@x~m~o?38Yhiy
=7=/4}ml@QB1nJ
]iQxb<
z;48)'
=Mr.O8j
I(._9B
Qy22n-2^]
UV#,/i
@:qGw+
(cn/d=$c+v8
-%bK6m
>PXSKMH^]P4Z.%-!.Outhyj$.'D{eckY1;28:3Phh}n
i?ET_HYJ9L^\O@Q .~
/Mgmcqn';1*;,_
Vx~gqg9Qtxn~Xx}pDD(
/USZLKF&U
\7l]4IU.
#EgAE7
Cnoskkci|)2
cAcuvs8\|lr
eMIRBZ
lGMYKkUR]WQ?
{]W]OT
N{xM;=8.- D7
yGjbuak
BAA_^\ZV
.jZmla@
JPPS"V
5kVJsk
0;<=32
B;lM0E
t\o+}W
\V|F >
7])o/O
d3F27n
}Pe-Tc
g9oK$N
R%$!0aZ
cezE^
RPX0if>
Bqh89YUd
*yFShSY
*0/(yQ
WuGF.#
7A~gw^
bwI=!N
xBfrJ\\
boQ?o)
lAU?`U(v
uK=%mb
_G`O5!F
d@(MKo
e^GVD|
(rrF> 4
'OZZS|
Ps8a*-L&
ZxOhG]
9=#3)'8
uG6y7l
kl^e".
~.lp<N
;Jf%hw
^x_39<*.)9<3U
lSXIZK
eAFDDD
g8@r5m=
+h,OaH
N>XvLuH
1b@|/q
_SIYiC
D[sfds
)7':Z|
dKxdl\a
g>\qHSZJK
A)#*<$#729_39<681Vil
oRP]Q`
{F@TEV
p \NI_
`hcgk`
8;.?0~py
)*8T|t|hu>+
aAE^N^
hCQEWwQVYS]3
6NJM% /I<
,L`o``}*9:>
Rxf`DpdTwtjtrxpk
gJJHZzZJOH
kUG[PQgqu2
|RPI[Mo
"+&..Fb
*>6&;taowhy
JHKJMLLNBCCAEGD
345rst
")(+87v
@745Jh(.)x
#AKIH#
kjhHGGCI
QcZEJi
jc5T!1>
We$$;*
=;:898
CN2@,:
C"rMSlr
u}UQ9%
dK|2Mx
~&vP=Y
j7z~cZG
4456!n
h):m3Aa
Yhw!"@B
(=`]JwJB
Vx&' f
.ZgxnE
{lP"8U
94t~m}2:
D'Qed'
4<v2Hp:
{tH v2
fx.a,p
u^L$yB
$*v3:um
(\1-Zq3
}8(;3p
=K>{/ /
UJY<*M+a
Il!z3:
?k uO@
n^)`,u
Gru9':
h#OIbj
*5Oc*`
S].-I3
v3)& E
Bc]mig
63p n9
js }ZL
S liSO
drus.;iD
P_N,Fp4Q
h`kce`vux
rv}uyv
!ICJ@R[8
dpvgxi
F( +?38Yafvgx681Vabp0
GYIZK>gA)
OHZ0GXOZK\/tP
356ERV
r.DoeqcCmjeoi
ug|5#/8):I
SUPFEH,_
pur305
>ehkjwv5
QoBJ]YS
TVGhd^
W9i.NRz]
&ekziB
Kzzyyvy
@|YZXQ
gf">;8a
hcTU[Zu
4I|i[Nq
1H-plDo
pa:M\YH
Z|oQZ?
/c(I4MR
{uvwf/
oahE-_
*Td&d/^
xyR3N8
=OlzYg
!iN,*d
$PjNJrdd
zu+?.<u{
yl"4J=
B^;=to
]+v4d_
PS:cL4{@{
,MyV A
<wixr7
4h?4}3
>(5Nzz?j
\c,/`YV
@Jkem
h*[93Ho
6>=^2v
'KATBFAQT[=]W^T^W4
xarc+',My~|||G+!4>09^`owhy596WbcO-
G^YJ[L?d@6
f,t(f3
[Czre-
8GjY,^6
7${M1b7
y[/]=b;
%){Q_L
6f+n&,.z
/G6#51&7([
!W_sxvwa*+7P/;)*>/
"LDOCOD%
O[^4.0cl
K MnO Q4S2U?W;Y?[|
89)Sqyo$Jb`{
>Afvaog}6Nblx.
cCPAcII\
zgj``y
b[^g@X
q]_UHTJFm
+%(, $,c
**>%;'-x
BUQEVG:cE/
![JK^O
vCtcrcjqkw/D
}N62:5VhO_q
rOM[L]
thvz-*Urxyfnah`{0!,-
:Pxvm^~o~lvPUMQ
$J^U]Q^?
)>-=9!&<&_y
48=(|nlUO
GP\SaC.
V@A@pT8
<.Nfjbro(>:+<-\
`pd8^u{oyY{|OEG)
iCIO]B
<DLK_ZQ7F
.]2G08
KzX[$h
okWOe?8~g5[
p-8v1`Y
`4aX<y
5\CC=F
EH'&Fh9
_q9rE1
\z>1C}
awfb(*
rFI r&Fj
:X?W-|
ZPM{%c
$3be=M
`6:g9%Z
Xj+ ty
Q'4s3A
d;YCot)%
+S<4ZBK
/e:"6`8
+_&&B7
CmftrM
+v6`LQ
x=37SE
I:@,D-
LJBN6
A]V)@A
B2zVwW
keJ&=>
Z]bJ||
Q}# 0`\
LXgJ#e
9X?14f
+"p93T
r#.-ph
&^soZ1*E
`ko~,%pa"_
C&W!R):
t\joH.
e}0sNF
I;C"hI
=>.]GE
m`4VLx
9uZgdF-,
2Eyd)
-e$%gS
K^l^IX
8Q$\9%
5d/&2c
2;V5H^
Qc:uz;
D0_?@g
3.$;P<
kDk$Z]
kVSJId
Ag>){c
q5!q=,c
W-z$05
;1`,S#n!Q
@*DZl(
=e1`-6
.CI $TT
?ZRS|-w
KaLOyK
S]%zf7U
W{x1+
:s-RT7
oHs!M5
oHUbX?
;CzO@h<
cAp}@v
McpoL/8
ovLZjg
;nt/tH
sA4F;U>$
~j=z)2
ZX/)9K
\`%h}$[[O
3{m0rA
YhLH%'
G8I{R,
,?j_<'
KL {~'
N9Jb=y
(76n8X
Tx$V@*
4 mE[#
~!hRXd
pi++ZO2o
?vk&k%
uSU'qu
Hr#+ B
A>gu,m
hsa?34
Oj{Coc
$NDY?J
[@_^!(
0Yy!N
px#T^y
okYw@|
tqc&1qvf-<~{
"li{>)in~E
cr<9+nyQ
!dw74$cr
)AKBT\[OJA'KAT^PY>
yqsI!+"(*#@}um~o?38Yf`g`lmP>291=
89)Kmgm
d-9;0!2A
i3[r~TDfFGJBB"
!_Y\JQ\8K
vEwNy0
x86$?=)
b:a}E`f
>4i"jK
3}(W]kx
.MrDo
w}pzt}
..;,=q}J+
,BFMEIF'
y//6Ik
3%<0:.c
,&2jSu
L6 00!<A
/60AGDD}W:3?/
35Y645[
;?Q><=S
$!I&$%K
,-A.,-C
J$,'+',M
|j{l",%Zmn|
,&2w 55(
N\B{]2
YBNEwQ<
bfmeif
9>0!2|v
+$6V~rzjw
oCGXH\
v]SGQqSTW]_1
q[Q'5*rdrpgxi
ArsD<$#729_.
xctGD$
I=##DJ
qJ^&~f
%YPu-R
;J!%sZk
~1wSGs
>+&d%OA
tGzP*T
p,~J"L+
ohPQ#S
*D7aCRDPXz
7AL}X>PH
C<YRWFDd
p{&@dV
|-|bDi
y7knZYY
mQx[Q,
HfNz_k
>_>)`+?1s
>UBT(c
/X5h <
CH {#J,
q',y=l
-|?],U
e<+%BWpW
}>){5zrk
u30k_?
kRp`~9QQ
tiDn)&KMvF
Cw9qx5
W!E^w`ZV
bz-<Pv
Fvud"E
5ME/(@E
;$Ow?8
,L(g6v)
5_]~@1
>BeQ.Mx@
`({]6q
*jM_0E2
/}F>}5
(zT~3J
Oi4-!]V
E~a\dwX
ra}`_b
(L&/BWV
wZ'T2G*
8+HGE]6
wh6T^_W
X3@e3Q
[ 72Hb
?M4Y$m
`,pmSx
s~u)`t=
*h]&O]T
n^vkCG
#M|+2
Tx\uZo
!r|qMq.4
W{MUQo
XB0D9E
3l8F(U
~NvfK<
$2g2m,
Yw2LE\C
|JypjCnr
`QlApM
#wZ9\V
o`EJBF
P(=c{\
2std&'
6X} dY
7p*i{rc
)N4^/=
>)$U( }%hD=
,:zr<h
<=+{s`
S#U-?.
i*`wD7F
@_So3a
LT!M(I
z:gQR{
!jR%;vh|
Z}TMhZe+
jJDmF]TY@W
([ZlZ9
(9}R_&
LTV0FJ
7;37>%
xG*]I$9sU
p*<k)
Y5K)i
/IR Rdo
Z{brB#
0~dB$6
$EXt_~
twPH1z
eMdJN/
J5V5}A
8\e?oN-w
.X\OH?^)UB
eVq}Y[
!%)w(Q
u\!0L:
2v%KhO
^sJe'#
}.Gp4lB
4eSJ_b
6C=z63
jF&+mv;7Y
.FHe)P
!9^{yL
8jmmQ(f
!<LJ~ ]
9}N=Is|
R}{<UN
"gxFZ/
=vD5z[A8
2M^ u$
7le+<,
vh+eA3>K},
jVxVdHH
>]!/Br
2,R3P=
w\jJ`|
az&Oxr
MG:qZ]fmJ
4Wd@t#C
h_$),z
=F8>',
,;#2 &W
JfDfgA
4o5OW!
At9Y^!7
K_dl)P7
!+ Bqs
wm&^r|h>
?Ss`qSyyl6LHK^LF
qoJJBjN}
cOICZFDH {>
sY[V^RRZ
v$$,7-1?j
&3>66tbowhy
7MV_PAR!~(|IFs
PLkmcIoR
&IBH^w|dt
Zzsy+$6H~{tmkRX
eYHH\F^V
zPPXCQMC
nKO0-'.!+2gxwtAc
7 7'?',6({do~o@3h]Zo
fU\O@Q
elT#<=
(PAobkez/%#+
;Syyl_swy/>(
"LDOCOD%
pXPX4)b{pevg
%!:*"~
=:5?9Wq
TF_[IZK>gPQz
lWWbaA
6Ibq i
9;K9%'
2H6@0r2v,
JJFog^
TUXWXc\
.4;4)5
_=#ted
&MOFAB
A7Tr^0
1Zue#0
*kszd=
Lr/^)
Dec$J-
k4>lc^
5B zp:
d=+Q?g
LwZHz(
MW<9 m*`
<5E${/
qc5D*=
G\ox{5
y(g\%fo(
t8 /\0
LFz7~1
;O|esD
JwLpVb
GIz^Qyt
LNtUa8
OR R*,7
[7=0&"%=87Q93:0
h[PEVG
a][][E{
rAI[L]
Ddq`akbff}Ldby}T0)%3$5D
xp{OCH)
|T\T@]
y)-6&6j
).!+5[lm^&"%=87Q$
<.Pfcluszp"Jhblj9>]appd~v~2RxxpkIU[
vSWXEOFICZ
sYYL}_H_OWO4.0c||fwh
nxeaX|
kmc|oig@TWUDPSQH\_]LX[Y-{@G/@CAXLOM!wLG
Hdkdlq&1?>
$Hh}lu
f39'''
6\tri\]OYy
UUHs_R%n
1-$*Mg
>6>6te\x
}fgjN:+
I^S\gA)
EXAO[L],u
1+}S5T
*$2gK]
>LN?0'
Ph B;u
ba>P,8
X "P4/
bgdGPg`a\M8
8%B'sr
^2N:i0
d=Ua&~
4Mc"!}V
nv|ynz,|z~U
:SQ'R-
"GVvXG
\x~CP_
Zk_{A6
1+yL(|K-
F"rE'u@$h_-x
AcQh/P3M
QB< Mc
~]oy`^
5d9z1*$
;k+g-F
MpBS*T
$DvS'E
"cQHK~!-
\$q{^<F
2 !YV}
|NIYJ[
Iegmplr~%A
$Xb[ayr}wq5/$8):I
2ZzSBGM@DHSnFD__v
0^RYQ]*K{pduf(*#@wpb
*>6&;tlcwhy
y)Cgkgc.'Fxoi
gaw9[wq{b~l`34OhnoLDOFJQ
jB@[tTAPF\FCWK
eqppCe
eabsaefwmij{imn
UQRCQUV:b4`URg
~L@WHY
*OsiechMcicu1"
;FbruO:#$
1GhDKDLQ
jB@[vX^V
5%/&,&/L~zizk#/$Elm} 1;1#0ycc|m~
rM^%KS(T
?'d+7[!
.3O$xb
jq^v*F
rY[\9er
U7S%\,t/v+
RtI%I[
YJX/6[
#0_sAI
YLul{2:}
f3l5z:
}R1Y8&
# /:mG
151w270
XMXi~/
:|H(#*
t.A[IDRK#BkbXdQHR#!"&8_s}wnrhd3W*
gMGJBNFN
bHH@[YEK
cWlTR_RZZ`prsduf
.?.+!40<'
zjll~o@3h>n[Xm
d^@ARCT
}=6u/E
+Vse|pzn#NGKV~|g@lfr*
5Y}n{YOOV
g}kf|e
`MDzFovp
oDMK%,
-"*z{g
/,%>:=)y
7;73~w
(?9/71
VGFGpT:
,375%?>>)2>9P
V~|gZt{r7R{rHtAXb
n\HFBOl@H\T
&-".3h|||Fb
:80dwa`zk|
bPSK\M
:=hbZ2g
:f#}h.~
nuq#53&7([
$^h}`ecqvg5' 8):I
2SzDHCaK]}
0^RYQ]*Ks{duf(*#@wpb
RARC6oI$
OBDRCT'|X*
1"6=0(4(1>:"4S
vzqyur
)-<->pBK(
{MJK% aSAQ[B
|//6&*15g|zj{l D`
4!<!'52+yno|m~
1[L]NZID\@TMBFV@'qBCt
pd-Sebc
'Ykyicz/"1"3F 9Twwn~rim?
zLYDY_MJC
w^XT_}/9
sdufrq|dxluz~~h
Yjk\26=596Wl
527#b%
789:;<=>>%1"#$%&7v9
.aHstuvwxyz}
`abs:u\ghijklmkoWARSTUVG
I`[\]^^CGJELUFGHIJ[
5!23456'f)
;<=>< )'&!5&'()*;r=
pqrc*eLwxyz{~
zwhqbcdefw6yPklmnlRSWP\EVWXYZK
Md_@ABCFG@EHYJKLMN_
440:<%6789:+b-
? !" &' #.9*+,-.?N
uarstuvg&i@{|}~
ddjkaufghij{2}ToPQRSRVQWQIZ[\]^O
QxCDEFGNJMHM]NO
01232=?0=):;<=>/~1
#$%&' /-"%=./
yptvwevwxyzk"mD
`abcmd``lyjklmn
AhSTUVWQX][[M^_@ABS
U|GHIJHNOFI
345669<;=?->? !"3z5
'()**-(/&
pqrrupuv
iz{|}~o>qXcdeffilmmo}noPQRC
ElWXYZZ]XYWCQBCDEFW
YpKLMNN
012#j%
789::?:>>%1"#$%&7v9
.aHstuvv{q}ztm~
`abs:u\ghijjedgmSARSTUVG
I`[\]^^IHKCEUFGHIJ[
9!23456'f)
;<=>='("#$5&'()*;r=
pqrc*eLwxyzy{ux~eqbcdefw6yPklmnmWYZSQEVWXYZK
Md_@ABAM@BBOYJKLMN_
09707%6789:+b-
? !" $-#&)9*+,-.?N
tarstuvg&i@{|}~|`hbfcufghij{2}ToPQRPT\VT_IZ[\]^O
QxCDEFDH@HLK]NO
012065611):;<=>/~1
#$%&$*+.+$=./
rrsusevwxyzk"mD;"0;?1'\kdv
2&8~nPVhL6
HXZ]L]N=z^;
VAKYJ[.wQ6
endstream
endobj
5 0 obj
<</Length 4007/Subtype/XML/Type/Metadata>>stream
<?xpacket begin="
" id="W5M0MpCehiHzreSzNTczkc9d"?>
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 4.2.1-c041 52.342996, 2008/05/07-20:48:00 ">
<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
<rdf:Description rdf:about=""
xmlns:pdf="http://ns.adobe.com/pdf/1.3/">
<pdf:Producer>Acrobat Distiller 9.0.0 (Windows)</pdf:Producer>
</rdf:Description>
<rdf:Description rdf:about=""
xmlns:xmp="http://ns.adobe.com/xap/1.0/">
<xmp:CreatorTool>Acrobat PDFMaker 9.0 Word
</xmp:CreatorTool>
<xmp:ModifyDate>2011-04-19T14:35:53+08:00</xmp:ModifyDate>
<xmp:CreateDate>2011-04-19T14:23:41+08:00</xmp:CreateDate>
<xmp:MetadataDate>2011-04-19T14:35:53+08:00</xmp:MetadataDate>
</rdf:Description>
<rdf:Description rdf:about=""
xmlns:dc="http://purl.org/dc/elements/1.1/">
<dc:format>application/pdf</dc:format>
<dc:creator>
<rdf:Seq>
<rdf:li>FtpDown</rdf:li>
</rdf:Seq>
</dc:creator>
<dc:title>
<rdf:Alt>
<rdf:li xml:lang="x-default"/>
</rdf:Alt>
</dc:title>
</rdf:Description>
<rdf:Description rdf:about=""
xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/">
<xmpMM:DocumentID>uuid:aba53d5c-8a5d-4f69-b4c6-400b3f7d4044</xmpMM:DocumentID>
<xmpMM:InstanceID>uuid:bb5bf9f5-e799-4cbe-99df-6e363bcbd507</xmpMM:InstanceID>
<xmpMM:subject>
<rdf:Seq>
<rdf:li>2</rdf:li>
</rdf:Seq>
</xmpMM:subject>
</rdf:Description>
<rdf:Description rdf:about=""
xmlns:pdfx="http://ns.adobe.com/pdfx/1.3/">
<pdfx:Company>www.ftpdown.com</pdfx:Company>
<pdfx:SourceModified>D:20110419062104</pdfx:SourceModified>
</rdf:Description>
</rdf:RDF>
</x:xmpmeta>
<?xpacket end="w"?>
endstream
endobj
6 0 obj
<</Author(FtpDown)/Company(www.ftpdown.com)/CreationDate(D:20110419142341+08'00')/Creator(
rH)/ModDate(D:20110419143553+08'00')/Producer(Acrobat Distiller 9.0.0 \(Windows\))/SourceModified(D:20110419062104)/Title()>>
endobj
8 0 obj
<</#E6#AD#A3#E6#96#87 14 0 R>>
endobj
11 0 obj
<</DropCap/Figure/Endnote/Note/Footnote/Note/Frame/Div/InlineShape/Figure/Outline/Span/RB/Span/RT/Span/Ruby/Span/Shape/Figure/Strikeout/Span/Subscript/Span/Superscript/Span/TOA/TOC/TOAI/TOCI/TOF/TOC/TOFI/TOCI/TextBox/Div/Underline/Span/#E6#AD#A3#E6#96#87/P>>
endobj
14 0 obj
<</EndIndent 0.0/O/Layout/SpaceAfter 0.0/SpaceBefore 0.0/StartIndent 0.0/TextAlign/Justify/TextIndent 0.0/WritingMode/LrTb>>
endobj
16 0 obj
<</Names 24 0 R/Extensions<</ADBE<</BaseVersion/1.7/ExtensionLevel 3>>>>/Lang(
S)/LastModified(D:20110419142342)/MarkInfo<</LetterspaceFlags 0/Marked true>>/Metadata 5 0 R/PageLabels 2 0 R/PageLayout/OneColumn/Pages 4 0 R/PieceInfo<</MarkedPDF<</LastModified(D:20110419142342)>>>>/StructTreeRoot 7 0 R /Ac#72#6fF#6f#72#6d 46 0 R /Type/Catalog>>
endobj
17 0 obj
<</Annots 28 0 R/Contents 19 0 R/CropBox[0 0 595.22 842]/MediaBox[0 0 595.22 842]/Parent 4 0 R/Resources<</ExtGState<</GS0 20 0 R>>/Font<</TT0 18 0 R>>/ProcSet[/PDF/Text]>>/Rotate 0/StructParents 0/Type/Page>>
endobj
18 0 obj
<</BaseFont/TimesNewRomanPSMT/Encoding/WinAnsiEncoding/FirstChar 32/FontDescriptor 21 0 R/LastChar 117/Subtype/TrueType/Type/Font/Widths[250 0 0 0 0 0 0 0 0 0 0 0 0 0 250 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 722 0 0 0 0 0 0 0 0 0 0 0 556 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 444 0 444 500 444 0 0 500 0 0 0 278 778 500 500 500 0 333 389 278 500]>>
endobj
19 0 obj
<</Filter/FlateDecode/Length 187>>stream
endstream
endobj
20 0 obj
<</OP false/OPM 1/SA false/SM 0.02/Type/ExtGState/op false>>
endobj
21 0 obj
<</Ascent 891/CapHeight 1000/Descent -216/Flags 34/FontBBox[-568 -307 2000 1007]/FontFamily(Times New Roman)/FontName/TimesNewRomanPSMT/FontStretch/Normal/FontWeight 400/ItalicAngle 0/StemV 82/Type/FontDescriptor/XHeight 1000>>
endobj
24 0 obj
<</JavaScript 25 0 R>>
endobj
25 0 obj
<</Names[(aa)26 0 R]>>
endobj
26 0 obj
<</JS 27 0 R/S/JavaScript>>
endobj
27 0 obj
<</Filter[/FlateDecode]/Length 1023>>stream
O[2\a0
L4P2 fg
LP 4&z/HaB5
]&&5&\<
mld}(\
BT9V.%cM
%Oo=t)6s
#tic<U^
4j?[|E
>lo)Qc\
\0=d=F
OA3X{i
endstream
endobj
28 0 obj
[29 0 R]
endobj
29 0 obj
<</AP<</N 40 0 R>>/BS<</S/S/Type/Border/W 0>>/Border[0 0 0]/F 68/NM(RM1)/P 17 0 R/Rect[111.05 518.922 394.05 579.922]/RichMediaContent 30 0 R/RichMediaSettings<</Activation<</Condition/PV/Configuration 31 0 R/Presentation<</NavigationPane false/PassContextClick false/Style/Embedded/Toolbar false/Transparent false>>/Type/RichMediaActivation>>/Deactivation<</Condition/XD/Type/RichMediaDeactivation>>>>/Subtype/RichMedia/Type/Annot>>
endobj
30 0 obj
<</Assets 38 0 R/Configurations 39 0 R>>
endobj
31 0 obj
<</Instances 32 0 R/Subtype/Flash>>
endobj
32 0 obj
[33 0 R]
endobj
33 0 obj
<</Asset 34 0 R/Params 35 0 R>>
endobj
34 0 obj
<</EF<</F 37 0 R>>/F(8.swf)/Type/Filespec/UF(8.swf)>>
endobj
35 0 obj
<</Binding 36 0 R>>
endobj
36 0 obj
/Background
endobj
37 0 obj
<</DL 2557/Length 2557/Params<</CheckSum<EA5E5640680FEDEAF4C535318BFEB787>/CreationDate(D:20110411084318+08'00')/ModDate(D:20110411083250+08'00')/Size 2557>>>>stream
default
String
length
charCodeAt
fromCharCode
charAt
TextFormat
VkduhgRemhfw1surwrw|sh
default
getSize
Gdwh1surwrw|sh
wwrsurw@w+th
getTextExtent
zwsw3surwrw+th
getDay
getFontList
TextField
IsRunning
setMode
LoadVars
getDepth
endstream
endobj
38 0 obj
<</Names[(
f)34 0 R]>>
endobj
39 0 obj
[31 0 R]
endobj
40 0 obj
<</BBox[0.0 0.0 283.0 61.0]/Length 844/Matrix[1.0 0.0 0.0 1.0 0.0 0.0]/Resources<</ExtGState<</GS0 42 0 R>>/ProcSet[/PDF/ImageC]/XObject<</Im0 41 0 R>>>>/Subtype/Form>>stream
/GS0 gs
283 0 0 61 0 0 cm
/Im0 Do
0 0 0 1 k
q 1 0 0 1 12 8 cm
-2.071 0.001 -3.749 1.679 -3.75 3.75 c
-3.75 15.751 l
-3.749 17.822 -2.071 19.5 0 19.501 c
12 19.501 l
14.071 19.5 15.749 17.822 15.75 15.751 c
15.75 3.75 l
15.749 1.679 14.071 0.001 12 0 c
0 0 0 0 K
0.5 w
q 1 0 0 1 12 8 cm
-2.071 0.001 -3.749 1.679 -3.75 3.75 c
-3.75 15.751 l
-3.749 17.822 -2.071 19.5 0 19.501 c
12 19.501 l
14.071 19.5 15.749 17.822 15.75 15.751 c
15.75 3.75 l
15.749 1.679 14.071 0.001 12 0 c
0 0 0 0.5 k
q 1 0 0 1 9.8749 11.751 cm
0.001 -1.173 0.951 -2.122 2.124 -2.126 c
14.125 -2.125 l
15.299 -2.122 16.248 -1.173 16.25 -0.001 c
16.25 11.999 l
16.248 13.173 15.299 14.123 14.125 14.124 c
2.125 14.124 l
0.951 14.123 0.001 13.173 0 11.999 c
0 0 0 1 k
q 1 0 0 1 14.1989 22.8899 cm
8.902 -5.14 l
0 -10.279 l
endstream
endobj
41 0 obj
<</BitsPerComponent 8/ColorSpace/DeviceRGB/Filter/FlateDecode/Height 127/Length 6468/Subtype/Image/Width 589>>stream
${:+v@K
w}zk|q
81^L0r
*<F>^{
^afiZi`
=.=C>R=a>p=
w;zSzw|
4(mDj8
id|,:;;?
Q3TJC5
54A4M4Y
K"""""""""""
Y"""""""""""""""""""""""""""""""""z
Y"""""""""""""""""""""""z
1=^g Z
!"""""""
!.lkaR}7}:
t>p8"UdD
Kt&m>g~
7\(""""""zg
SS=wW)
DDDDDDDDDDDDDDDDDDDDD
endstream
endobj
42 0 obj
<</CA 1.0/Type/ExtGState/ca 1.0>>
endobj
46 0 obj
<</#58#46#41 47 0 R>>
endobj
47 0 obj
<</Le#6e#67#74h 435>>
stream
<?xml version="1.0" encoding="UTF-8"?>
<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
<config xmlns="http://www.xfa.org/schema/xci/2.6/">
<present>
<pdf>
<interactive>1</interactive>
</pdf>
</present>
</config>
<template xmlns="http://www.xfa.org/schema/xfa-template/2.6/">
<subform name="form1" layout="tb" locale="en_US">
<pageSet>
</pageSet>
</subform>
</template>
</xdp:xdp>
endstream
endobj
0000000000 65535 f
0000000000 00000 f
0000000614 00000 n
0000000648 00000 n
0000000672 00000 n
0000000724 00000 n
0000004808 00000 n
0000000000 65535 f
0000005093 00000 n
0000000000 65535 f
0000000000 65535 f
0000005139 00000 n
0000000000 65535 f
0000000000 65535 f
0000005414 00000 n
0000000000 00000 f
0000005555 00000 n
0000005898 00000 n
0000006124 00000 n
0000006488 00000 n
0000006745 00000 n
0000006822 00000 n
0000000000 00000 f
0000000000 00000 f
0000007066 00000 n
0000007105 00000 n
0000007144 00000 n
0000007188 00000 n
0000008284 00000 n
0000008309 00000 n
0000008759 00000 n
0000008816 00000 n
0000008868 00000 n
0000008893 00000 n
0000008941 00000 n
0000009011 00000 n
0000009047 00000 n
0000009075 00000 n
0000011827 00000 n
0000011876 00000 n
0000011901 00000 n
0000012949 00000 n
0000019563 00000 n
0000000016 00000 n
0000000279 00000 n
0000000415 00000 n
0000000000 00000 n
0000000000 00000 n
trailer
<</Size 46/Root 16 0 R>>
0000000000 65535 f
trailer
<</Size 46/Root 16 0 R/Info 6 0 R/ID[<45DE6550AFCA47B285E01092BDBC672F><1D1FF62741FE4D418CD89CC20DE65FAA>]/Prev 19613 >>
startxref
Acrobat PDFMaker 9.0 Word
ABCDEFGHI
Dropped Files
220d543c6f5e2b14_shareddataevents
| File name | 220d543c6f5e2b14_shareddataevents |
|---|---|
| File size | 3072 bytes |
| File type | SQLite 3.x database |
| MD5 | 0cb262a1f53b9388f3fa782cc8da8b7c |
| SHA1 | 7670c6d9cd65bf49fd388be1a676c7523a6154f9 |
| SHA256 | 220d543c6f5e2b14af73096d4c686d01ef530dde97faa16581a6512c1af5573d |
| SHA512 | 303ebe9b74b8bc326e09fdb83c3c616482eaa02861ac6cb8eb8c86e69f67e02259847a0e8d4173b149a06b51e380ebd63c0cbb510175c160ec71114765b2cf6f |
| Ssdeep | 12:HLS0qgtO9OiyopOz2VVXet3aQK+GyMFO+rlhurs7qllZ2atl4h2:r8Rx/XYKQvGJF7ursClZ3l4c |
| Yara | None matched |
| VirusTotal | Search for Analysis |
f4d656ef5c95da9e_adobearm.log
| File name | f4d656ef5c95da9e_adobearm.log |
|---|---|
| File size | 3030 bytes |
| File type | ASCII text, with CRLF, CR line terminators |
| MD5 | 1bce32edefb21de3bc943bb2b787e656 |
| SHA1 | 76ef05dfee29f3a7ed43283761eb9c7269797672 |
| SHA256 | f4d656ef5c95da9ebba355d43cedee6a4f937ffbdaf1701dd62829cc1d1465ae |
| SHA512 | 6b4aa0e4e3083289d741e9d6417302d873b5a6a804cb12884c1f28581a94b9817cad51f52dad835f7f549f650d6b9183b86ecc4eba11cf17c1f953621d513787 |
| Ssdeep | 48:ob17Q2eMbJ5d1rogAafH5L1XQmaI7Z5z1DkieM7t5Bu1vdf3e57KfDV6YNot0k94:ob1kFmJ5d1sNsH5L1A1aZ5z1A52t501Z |
| Yara | None matched |
| VirusTotal | Search for Analysis |
4d7f480cf854fe56_acecache10.lst
| File name | 4d7f480cf854fe56_acecache10.lst |
|---|---|
| File size | 1565 bytes |
| File type | data |
| MD5 | abb1825273c1e859babb41ac8a72af31 |
| SHA1 | b609942e14a3fd142cce39cf68ea47f08e79963c |
| SHA256 | 4d7f480cf854fe56292ba57dc64ebb5242e9641408fe8f6e02e54afadfbb1a7f |
| SHA512 | 269f74daf146522bb5f074bf803d3b22e5c00b0bbc83f2a9df41601d8beddbff97de78df7bdca34482766c9965dcb7b5158acd6b657ccd7391fd81d7c1f1498d |
| Ssdeep | 24:ehkFwRfC0yJrBtkRlxFX5C0yJrK3l9XhqXbx8xqdXhqbFBC0yJrBWlV:e/Rq0yROlY0ysl1heaoVhj0yilV |
| Yara | None matched |
| VirusTotal | Search for Analysis |
a479dd2807cb9817_ArmUI.ini
| File name | a479dd2807cb9817_ArmUI.ini |
|---|---|
| File size | 163994 bytes |
| File type | Little-endian UTF-16 Unicode text, with CRLF line terminators |
| MD5 | 927e703153e62a1cb9a4437659144bda |
| SHA1 | d293a6eb612b6c3bcddeec698e40dbebb5c61879 |
| SHA256 | a479dd2807cb9817ef3ef7a31f3b7582339785e921b4284e55a1387dc38ec770 |
| SHA512 | 0a1d099fccceadb38c7326a9791da18ddeff069600359b415744ae46641b8f041e4a31b00281a996f54b0991dbdf7bdbd0701f6cb71189afd42c207c4631d228 |
| Ssdeep | 3072:kT4CJ4WTbmKk61NmSTBjDT7lV8MztutF4NVxcCXXYAF5CPD:9EYJ |
| Yara | None matched |
| VirusTotal | Search for Analysis |
dd1729eff12c228c_d3d9caps.dat
| File name | dd1729eff12c228c_d3d9caps.dat |
|---|---|
| File size | 664 bytes |
| File type | data |
| MD5 | e0e3c06b08e23f5d0f39a5d5ed3d9166 |
| SHA1 | 46928c9e53d7b85f7525df2a0cd2851c9c035f02 |
| SHA256 | dd1729eff12c228c6447a352e6d96b68c138f8d8aef35b66c9d922dffb2c5393 |
| SHA512 | 314c92a6794d78dc3c8cc160433b6c6f4c7e0e320b63758427b19e3499010d96fd5cb6740f3cff92d82e4cd2d4f8f93dc0fdb6be286a7931407a8e8136906adb |
| Ssdeep | 3:ZllKbllVnIlqQRi5BBl//lHlljlfltl+lp/5tAalB/AMlGM/JlpllDlHl/lr/tmz:8b/+Ni///r1aR5tAanDGM/Ja4llCl |
| Yara | None matched |
| VirusTotal | Search for Analysis |
2a2e0ba33d793244_usercache.bin
| File name | 2a2e0ba33d793244_usercache.bin |
|---|---|
| File size | 9662 bytes |
| File type | data |
| MD5 | 912bc7140ba3596f83450d830b7c9557 |
| SHA1 | 0bae66884a3e091bd6095923d4add3984f3e8db2 |
| SHA256 | 2a2e0ba33d79324445847a0128ca611fcc50c82a3556fa9a1478405f990843d2 |
| SHA512 | e9e45522441f2dfcfb2cd273be300a0b2add972c62f7496326a3fc5c45e4f318ca4d446ae2676360958429e39b91c1a7ee677a95d710d2936d5d48b1854dc3f1 |
| Ssdeep | 96:stIHhqWwdwlvw5SR73kAUVokJUJ0JMSJ81Wkhg28c1qOeN6hLWjAHo+1rOAq8oNs:sHWwdwlvwsR3UVoLpB+OeN6LWwTAAk8 |
| Yara | None matched |
| VirusTotal | Search for Analysis |
70f141a558422e95_a9r885d.tmp
| File name | 70f141a558422e95_a9r885d.tmp |
|---|---|
| File size | 358 bytes |
| File type | PDF document, version 1.6 |
| MD5 | 2c8f084bd05a8710821c89ffc79a46a6 |
| SHA1 | bbed4ce9c6b0d045990c3a3746577b28481cca93 |
| SHA256 | 70f141a558422e9543132ceefc971ef126cbe7be7a163ba4e81aee43248ca6a8 |
| SHA512 | 5d2c6bec8ec7c0013453512b1fb335d3e2dd581a95ad42d2465ff03101daf54ad74b8d9d77bf638e360548776bed03b7c79f96fecc7e67e8166d2d1ff930b23e |
| Ssdeep | 6:IngVMrexJzJT0y9VEQIFVmb/eu2g/86S1kxROOucpQBcpQtvLCSyAAO:IngVMre9T0HQIDmy9g06JX+cpQBcpQtF |
| Yara | None matched |
| VirusTotal | Search for Analysis |
Network Analysis
Behavior Summary
File-Read
- C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini
- \\?\PIPE\lsarpc
File-Written
- C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini
- \\?\pipe\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E009524054672thsnYaVieBoda
- C:\Documents and Settings\ardi\Local Settings\Temp\AdobeARM.log
- \\?\PIPE\lsarpc
- C:\WINDOWS\system32\d3d9caps.dat
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin
- \\?\PIPE\lsarpc
- C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst
- C:\Documents and Settings\ardi\Local Settings\Temp\A9R885D.tmp
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents
- C:\WINDOWS\system32\d3d9caps.tmp
File-Deleted
- C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini
File-Opened
- C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini
- \\?\pipe\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E009524054672thsnYaVieBoda
- C:\Documents and Settings\ardi\Local Settings\Temp\AdobeARM.log
- C:\
- \\?\PIPE\lsarpc
- C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\
- C:\
- C:\Documents and Settings\ardi\Application Data\
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf
- C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\
- C:\Program Files\Adobe\Reader 9.0\Resource\
- C:\Program Files\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf
- C:\WINDOWS\Web\wallpaper\Bliss.bmp
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB
- C:\WINDOWS\system32\wininet.dll
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf
- C:\WINDOWS\system32\urlmon.dll
- C:\Program Files\Adobe\Reader 9.0\Resource\CMap\
- C:\WINDOWS\system32\d3d9caps.tmp
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\
- C:\Documents and Settings\ardi\Local Settings\Temp\A9R885D.tmp
- C:\Program Files\
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api
- C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\
- C:\WINDOWS\system32\VBoxDisp.dll
- C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\
- C:\WINDOWS\system32\Macromed\Flash\
- C:\WINDOWS\system32\wdmaud.drv
- C:\WINDOWS\system32\spool\drivers\color\is330.icm
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api
- C:\WINDOWS\system32\rpcss.dll
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\
- C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api
- C:\Program Files\Common Files\Adobe\
- C:\Documents and Settings\ardi\Application Data\desktop.ini
- C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\
- C:\Documents and Settings\ardi\Local Settings\Application Data\
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\
- C:\Program Files\Common Files\Adobe\ARM\1.0\
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api
- C:\Documents and Settings\ardi\Local Settings\Temp\
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\
- C:\WINDOWS\system32
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api
- C:\Documents and Settings\ardi\Local Settings\Temp\APT_ATT11990.pdf
- C:\Program Files\Adobe\Reader 9.0\Resource\CMap
- C:\WINDOWS\system32\rsaenh.dll
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api
- C:\WINDOWS\system32\spool\drivers\color\kodak_dc.icm
- C:\Program Files\Common Files\
- C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\JSByteCodeWin.bin
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf
- C:\Documents and Settings\ardi\
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\
- C:\Documents and Settings\ardi\Local Settings\Temp
- C:\Program Files\Adobe\Reader 9.0\Resource\Font
- C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\
- C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V
- C:\WINDOWS\system32\spool\drivers\color\
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api
- \\?\PIPE\lsarpc
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api
- C:\WINDOWS\system32\d3d9caps.dat
- C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api
- C:\Documents and Settings\
- C:\Documents and Settings\ardi\Application Data\Adobe\
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api
- C:\Documents and Settings\ardi\Local Settings\
- C:\Program Files\Adobe\Reader 9.0\Reader\
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf
- C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api
- C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf
- C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api
Registry Key-Opened
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
- HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
- HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\PagedBuffers
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdobeARM.exe\RpcThreadPoolThrottle
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000
- HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000
- HKEY_CURRENT_USER\SOFTWARE\Adobe\Acrobat Reader\9.0\Language\current
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010
- HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000
- HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000
- HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties
- HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\1.0\ARM
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000
- HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000
- HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe ARM\1.0\ARM
- HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
- HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\Installer
- HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010
- HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\AdobeViewer
Registry Key-Deleted
- HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\iNotify
Registry Key-Read
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\DisplayName
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\MaxRpcSize
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableLUAPatching
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\9.0\Language\current\(Default)
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\Debug
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010\Language
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableUserInstalls
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010\AuthorizedLUAApp
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\VersionMajor
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\DisplayVersion
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\AdobeViewer\EULA
- HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\Installer\Path
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\VersionMinor
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetConnectDisconnect
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisablePatch
- HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\tLastT_Reader
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockDown\bUpdater
Processes
registry filesystem process services network synchronization
lsass.exe PID: 660, Parent PID: 536
| Timestamp | Thread | Function | Arguments | Status | Return | Repeated |
|---|
AcroRd32.exe PID: 988, Parent PID: 828
| Timestamp | Thread | Function | Arguments | Status | Return | Repeated |
|---|---|---|---|---|---|---|
| 2016-11-03 00:31:46.582260 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => C:\WINDOWS\system32\kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.732260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.732260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.742260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.752260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AGM.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.762260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\CoolType.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\CoolType.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.772260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\CoolType.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\CoolType.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.782260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.782260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.792260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.792260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ACE.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.802260 | LdrLoadDll |
basename => advapi32 module_address => 0x77dd0000 flags => 0 module_name => advapi32.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.802260 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.802260 | LdrLoadDll |
basename => advapi32 module_address => 0x77dd0000 flags => 0 module_name => advapi32.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.802260 | NtOpenFile |
file_handle => 0x0000006c filepath => \Device\KsecDD desired_access => 0x00100001 filepath_r => \Device\KsecDD open_options => 16 status_info => 0 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:46.802260 | NtOpenFile |
file_handle => 0x00000070 filepath => C:\WINDOWS\system32\wininet.dll desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\WININET.dll open_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:46.802260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\WINDOWS\system32\WININET.dll.123.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\WININET.dll.123.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.802260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\WINDOWS\system32\WININET.dll.123.Config desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\WININET.dll.123.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.812260 | LdrLoadDll |
basename => comctl32 module_address => 0x773d0000 flags => 0 module_name => comctl32.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.862260 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.862260 | LdrLoadDll |
basename => AcroRd32 module_address => 0x009f0000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.862260 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\WINDOWS\system32\rpcss.dll desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32\rpcss.dll open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:46.862260 | LdrLoadDll |
basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.862260 | LdrLoadDll |
basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => uxtheme.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.862260 | LdrLoadDll |
basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.862260 | LdrLoadDll |
basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.862260 | LdrLoadDll |
basename => uxtheme module_address => 0x5ad70000 flags => 0 module_name => C:\WINDOWS\system32\uxtheme.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.862260 | LdrLoadDll |
basename => Comctl32 module_address => 0x773d0000 flags => 0 module_name => Comctl32.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.872260 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.872260 | LdrLoadDll |
basename => BIB module_address => 0x07000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\BIB.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.892260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.892260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:46.892260 | LdrLoadDll |
basename => aiodlite module_address => 0x10000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Esl\aiodlite.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.892260 | LdrLoadDll |
basename => ADVAPI32 module_address => 0x77dd0000 flags => 0 module_name => C:\WINDOWS\system32\ADVAPI32.DLL |
SUCCESS | |||
| 2016-11-03 00:31:46.892260 | LdrLoadDll |
basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll |
FAILURE | |||
| 2016-11-03 00:31:46.892260 | LdrLoadDll |
basename => acrord32 module_address => 0x009f0000 flags => 0 module_name => c:\program files\adobe\reader 9.0\reader\acrord32.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.932260 | LdrLoadDll |
basename => UxTheme module_address => 0x5ad70000 flags => 0 module_name => UxTheme.dll |
SUCCESS | |||
| 2016-11-03 00:31:46.932260 | NtOpenFile |
file_handle => 0x000000b0 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.033260 | NtOpenFile |
file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.033260 | NtCreateFile |
create_disposition => 2 file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.033260 | NtOpenFile |
file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.033260 | NtCreateFile |
create_disposition => 2 file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.033260 | NtOpenFile |
file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.033260 | NtCreateFile |
create_disposition => 2 file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0 desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0 create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.033260 | NtOpenFile |
file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.033260 | NtOpenFile |
file_handle => 0x000000bc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.033260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin create_options => 100 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:47.053260 | LdrLoadDll |
basename => ole32 module_address => 0x774e0000 flags => 0 module_name => ole32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | CoInitializeEx |
options => 6 |
FAILURE | |||
| 2016-11-03 00:31:47.053260 | LdrLoadDll |
basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => C:\WINDOWS\system32\SHELL32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | LdrLoadDll |
basename => SETUPAPI module_address => 0x77920000 flags => 0 module_name => SETUPAPI.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | LdrLoadDll |
basename => rpcrt4 module_address => 0x77e70000 flags => 0 module_name => rpcrt4.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000f8 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtWriteFile |
buffer => H ¸¸ xW44ëï #Eg‰« ]ˆŠë ɟè +H` file_handle => 0x000000f8 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000f4 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtWriteFile |
buffer => H ¸¸ xW44ëï #Eg‰« ]ˆŠë ɟè +H` file_handle => 0x000000f4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtOpenFile |
file_handle => 0x000000fc filepath => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtOpenFile |
file_handle => 0x000000fc filepath => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3131303066333036662020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 16 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtOpenFile |
file_handle => 0x000000fc filepath => \??\STORAGE#Volume#1&30a96598&0&SignatureEBD7EBD7Offset7E00Length9FF2E4A00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\STORAGE#Volume#1&30a96598&0&SignatureEBD7EBD7Offset7E00Length9FF2E4A00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtOpenFile |
file_handle => 0x000000fc filepath => \??\STORAGE#Volume#1&30a96598&0&SignatureEBD7EBD7Offset7E00Length9FF2E4A00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} desired_access => 0x00100080 filepath_r => \??\STORAGE#Volume#1&30a96598&0&SignatureEBD7EBD7Offset7E00Length9FF2E4A00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} open_options => 16 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.053260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000fc filepath => \??\MountPointManager desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\MountPointManager create_options => 96 status_info => 0 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | NtOpenFile |
file_handle => 0x00000100 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | LdrLoadDll |
basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => SHELL32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | LdrLoadDll |
basename => ole32 module_address => 0x774e0000 flags => 0 module_name => ole32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:31:47.063260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\Common Files\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | CoInitializeEx |
options => 6 |
FAILURE | |||
| 2016-11-03 00:31:47.063260 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\Documents and Settings\ardi\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\Documents and Settings\ardi\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:31:47.063260 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeComFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeComFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:47.063260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.063260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\Reqrd\CMaps\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\Reqrd\CMaps\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.063260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.063260 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.073260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:47.073260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.073260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.083260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Reqrd\CMaps\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Reqrd\CMaps\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.083260 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.083260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.083260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.083260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.093260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.093260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.103260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.103260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.103260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.103260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.103260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.103260 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.113260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeSysFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeSysFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:47.113260 | LdrLoadDll |
basename => gdi32 module_address => 0x77f10000 flags => 0 module_name => gdi32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.113260 | LdrLoadDll |
basename => advapi32 module_address => 0x77dd0000 flags => 0 module_name => advapi32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.233260 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.233260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:47.233260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.233260 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.233260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.233260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.233260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.233260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.243260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.243260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.243260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.243260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.243260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.243260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.243260 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.243260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:47.243260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.243260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.243260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:47.243260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.243260 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.253260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.253260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.253260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.253260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.253260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.253260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.253260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.253260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.253260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.253260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.263260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.273260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.283260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.283260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.283260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.283260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.283260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.293260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.293260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.333260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.333260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.333260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.333260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.333260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.333260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.333260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.343260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.343260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.343260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.343260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.353260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.353260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.353260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.373260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.373260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.373260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.373260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.373260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.373260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.373260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.423260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.423260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.423260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.423260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.423260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.423260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.423260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.443260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.443260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.443260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.443260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.443260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.453260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.453260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.473260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.483260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.483260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.483260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.483260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.483260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.483260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.503260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.503260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.503260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.503260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.503260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.503260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.503260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.543260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.543260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.543260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.543260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.543260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.543260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.543260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.573260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.573260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.573260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.573260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.573260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.573260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.573260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.583260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.583260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.593260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.593260 | NtOpenFile |
file_handle => 0x00000114 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.593260 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.593260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\SY______.PFM create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.593260 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\Program Files\Common Files\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.593260 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.593260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\SY______.PFM create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.593260 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.593260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.593260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.593260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.593260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZX______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.603260 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.603260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\mmm\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\mmm\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.603260 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.603260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.603260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.603260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.603260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ZY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.603260 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\mmm\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\mmm\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zx______.pfm create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x000000fc filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeComFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeComFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:47.613260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\Reqrd\CMaps\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\Reqrd\CMaps\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\AdobeCMapFnt09.lst create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:47.613260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Reqrd\CMaps\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Reqrd\CMaps\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x00000108 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-H create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.613260 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.643260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.643260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000118 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.643260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.643260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\Identity-V create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.643260 | NtCreateFile |
create_disposition => 5 file_handle => 0x000000fc filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\UserCache.bin create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:31:47.643260 | NtWriteFile |
buffer => 4
67
75 FID.1:o: :F:ArialMT P:Arial L:$  "F:Arial # 89 FID.1:o: :F:Arial-ItalicMT P:Arial Italic L:$  ÿ "F:Arial # 85 FID.1:o: :F:Arial-BoldMT P:Arial Bold L:$ ¼ "F:Arial # 98 FID.1:o: :F:Arial-BoldItalicMT P:Arial Bold Italic L:$ ¼ ÿ "F:Arial # 91 FID.1:o: :F:Arial-Black P:Arial Black L:- „ "F:Arial Black # 95 FID.1:o: :F:ComicSansMS P:Comic Sans MS L:-  BF:Comic Sans MS # 105 FID.1:o: :F:ComicSansMS-Bold P:Comic Sans MS Bold L:- ¼ BF:Comic Sans MS # 94 FID.1:o: :F:CourierNewPSMT P:Courier New L:$  1F:Courier New # 108 FID.1:o: :F:CourierNewPS-ItalicMT P:Courier New Italic L:$  ÿ 1F:Courier New # 104 FID.1:o: :F:CourierNewPS-BoldMT P:Courier New Bold L:$ ¼ 1F:Courier New # 117 FID.1:o: :F:CourierNewPS-BoldItalicMT P:Courier New Bold Italic L:$ ¼ ÿ 1F:Courier New # 84 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf # 92 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf # 89 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf # 96 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf # 108 FID.1:o: :F:EstrangeloEdessa P:Estrangelo Edessa L:
 BF:Estrangelo Edessa # 123 FID.1:o: :F:FranklinGothic-Medium P:Franklin Gothic Medium L:$  "F:Franklin Gothic Medium # 136 FID.1:o: :F:FranklinGothic-MediumItalic P:Franklin Gothic Medium Italic L:$  ÿ "F:Franklin Gothic Medium # 79 FID.1:o: :F:Gautami P:Gautami L:8
 F:Gautami # 79 FID.1:o: :F:Georgia P:Georgia L:$  F:Georgia # 93 FID.1:o: :F:Georgia-Italic P:Georgia Italic L:$  ÿ F:Georgia # 89 FID.1:o: :F:Georgia-Bold P:Georgia Bold L:$ ¼ F:Georgia # 102 FID.1:o: :F:Georgia-BoldItalic P:Georgia Bold Italic L:$ ¼ ÿ F:Georgia # 76 FID.1:o: :F:Impact P:Impact L:'
 "F:Impact # 73 FID.1:o: :F:Latha P:Latha L:,  F:Latha # 99 FID.1:o: :F:LucidaConsole P:Lucida Console L:  1F:Lucida Console # 113 FID.1:o: :F:LucidaSansUnicode P:Lucida Sans Unicode L:1  "F:Lucida Sans Unicode # 84 FID.1:o: :F:Mangal-Regular P:Mangal L:6  F:Mangal # 79 FID.1:o: :F:Marlett P:Marlett L: ô F:Marlett # 116 FID.1:o: :F:MicrosoftSansSerif P:Microsoft Sans Serif L:$  "F:Microsoft Sans Serif # 91 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf # 86 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf # 88 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf # 90 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf # 78 FID.1:o: :F:MVBoli P:MV Boli L:4  F:MV Boli # 96 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf # 91 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf # 86 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf # 88 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf # 90 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf # 114 FID.1:o: :F:PalatinoLinotype-Roman P:Palatino Linotype L:+  F:Palatino Linotype # 122 FID.1:o: :F:PalatinoLinotype-Italic P:Palatino Linotype Italic L:+
file_handle => 0x000000fc offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:47.643260 | NtWriteFile |
buffer =>  ÿ F:Palatino Linotype # 118 FID.1:o: :F:PalatinoLinotype-Bold P:Palatino Linotype Bold L:+ ¼ F:Palatino Linotype # 131 FID.1:o: :F:PalatinoLinotype-BoldItalic P:Palatino Linotype Bold Italic L:+ ¼ ÿ F:Palatino Linotype # 84 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf # 73 FID.1:o: :F:Raavi P:Raavi L:5  F:Raavi # 76 FID.1:o: :F:Shruti P:Shruti L:6  F:Shruti # 79 FID.1:o: :F:Sylfaen P:Sylfaen L:*
 F:Sylfaen # 149 FID.1:k: :P:C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB M:C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\SY______.PFM # 78 FID.1:o: :F:SymbolMT P:Symbol L:'  F:Symbol # 76 FID.1:o: :F:Tahoma P:Tahoma L:'  "F:Tahoma # 86 FID.1:o: :F:Tahoma-Bold P:Tahoma Bold L:' ¼ "F:Tahoma # 105 FID.1:o: :F:TimesNewRomanPSMT P:Times New Roman L:#
 F:Times New Roman # 119 FID.1:o: :F:TimesNewRomanPS-ItalicMT P:Times New Roman Italic L:#
 ÿ F:Times New Roman # 115 FID.1:o: :F:TimesNewRomanPS-BoldMT P:Times New Roman Bold L:# ¼ F:Times New Roman # 128 FID.1:o: :F:TimesNewRomanPS-BoldItalicMT P:Times New Roman Bold Italic L:#
¼ ÿ F:Times New Roman # 93 FID.1:o: :F:TrebuchetMS P:Trebuchet MS L:%  "F:Trebuchet MS # 107 FID.1:o: :F:TrebuchetMS-Italic P:Trebuchet MS Italic L:%  ÿ "F:Trebuchet MS # 103 FID.1:o: :F:TrebuchetMS-Bold P:Trebuchet MS Bold L:% ¼ "F:Trebuchet MS # 114 FID.1:o: :F:Trebuchet-BoldItalic P:Trebuchet MS Bold Italic L:% ¼ ÿ "F:Trebuchet MS # 81 FID.1:o: :F:Tunga-Regular P:Tunga L:5  F:Tunga # 79 FID.1:o: :F:Verdana P:Verdana L:'  "F:Verdana # 93 FID.1:o: :F:Verdana-Italic P:Verdana Italic L:'  ÿ "F:Verdana # 89 FID.1:o: :F:Verdana-Bold P:Verdana Bold L:' ¼ "F:Verdana # 102 FID.1:o: :F:Verdana-BoldItalic P:Verdana Bold Italic L:' ¼ ÿ "F:Verdana # 82 FID.1:o: :F:Webdings P:Webdings L:  F:Webdings # 93 FID.1:o: :F:Wingdings-Regular P:Wingdings L:$  F:Wingdings # 125
6 Symbol
0
48
6 Symbol
1
49
10 AdobePiStd
0
44
8 SymbolMT
1
49
12 Verdana-Bold
1
63
7 Verdana
1
61
5 Arial
1
0
7 ArialMT
1
0
7 Marlett
1
28
12 Arial-BoldMT
1
2
18 Arial-BoldItalicMT
1
3
14 Arial-ItalicMT
1
1
14 CourierNewPSMT
1
7
19 CourierNewPS-BoldMT
1
9
25 CourierNewPS-BoldItalicMT
1
10
17 TimesNewRomanPSMT
1
52
17 LucidaSansUnicode
1
26
13 LucidaConsole
1
25
22 TimesNewRomanPS-BoldMT
1
54
28 TimesNewRomanPS-BoldItalicMT
1
55
9 Wingdings
1
66
24 TimesNewRomanPS-ItalicMT
1
53
17 Wingdings-Regular
1
66
21 CourierNewPS-ItalicMT
1
8
21 PalatinoLinotype-Bold
1
42
7 Gautami
1
18
16 EstrangeloEdessa
1
15
5 Latha
1
24
20 Trebuchet-BoldItalic
1
59
18 TrebuchetMS-Italic
1
57
18 Verdana-BoldItalic
1
64
11 Arial-Black
1
4
11 ComicSansMS
1
5
14 Verdana-Italic
1
62
6 Impact
1
23
16 ComicSansMS-Bold
1
6
16 Arial,BoldItalic
1
3
10 ArialBlack
1
4
15 ComicSansMSBold
1
6
22 MyriadCurrency-Regular
0
35
14 MyriadPro-Bold
0
38
16 MyriadPro-BoldIt
0
39
12 MyriadPro-It
0
37
15 CourierStd-Bold
0
13
22 CourierStd-BoldOblique
0
14
18 CourierStd-Oblique
0
12
10 CourierStd
0
11
14 MinionPro-Bold
0
32
16 MinionPro-BoldIt
0
33
12 MinionPro-It
0
31
17 MinionPro-Regular
0
30
17 MyriadPro-Regular
0
36
12 Georgia-Bold
1
21
18 Georgia-BoldItalic
1
22
7 Georgia
1
19
21 FranklinGothic-Medium
1
16
22 PalatinoLinotype-Roman
1
40
27 FranklinGothic-MediumItalic
1
17
14 Georgia-Italic
1
20
6 MVBoli
1
34
6 Mangal
1
27
14 Mangal-Regular
1
27
5 Raavi
1
45
5 Tunga
1
60
13 Tunga-Regular
1
60
6 Shruti
1
46
7 Sylfaen
1
47
18 MicrosoftSa file_handle => 0x000000fc offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:47.643260 | NtWriteFile |
buffer => nsSerif
1
29
23 PalatinoLinotype-Italic
1
41
6 Tahoma
1
50
27 PalatinoLinotype-BoldItalic
1
43
11 Tahoma-Bold
1
51
8 Webdings
1
65
11 TrebuchetMS
1
56
16 TrebuchetMS-Bold
1
58
11 ArialItalic
1
1
10 Arial,Bold
1
2
15 ArialBoldItalic
1
3
12 Arial,Italic
1
1
9 ArialBold
1
2
16 ComicSansMS,Bold
1
6
10 CourierNew
1
7
16 CourierNewItalic
1
8
17 CourierNew,Italic
1
8
14 CourierNewBold
1
9
15 CourierNew,Bold
1
9
20 CourierNewBoldItalic
1
10
21 CourierNew,BoldItalic
1
10
20 FranklinGothicMedium
1
16
26 FranklinGothicMediumItalic
1
17
27 FranklinGothicMedium,Italic
1
17
13 GeorgiaItalic
1
20
14 Georgia,Italic
1
20
11 GeorgiaBold
1
21
12 Georgia,Bold
1
21
17 GeorgiaBoldItalic
1
22
18 Georgia,BoldItalic
1
22
16 PalatinoLinotype
1
40
22 PalatinoLinotypeItalic
1
41
23 PalatinoLinotype,Italic
1
41
20 PalatinoLinotypeBold
1
42
21 PalatinoLinotype,Bold
1
42
26 PalatinoLinotypeBoldItalic
1
43
27 PalatinoLinotype,BoldItalic
1
43
10 TahomaBold
1
51
11 Tahoma,Bold
1
51
13 TimesNewRoman
1
52
19 TimesNewRomanItalic
1
53
20 TimesNewRoman,Italic
1
53
17 TimesNewRomanBold
1
54
18 TimesNewRoman,Bold
1
54
23 TimesNewRomanBoldItalic
1
55
24 TimesNewRoman,BoldItalic
1
55
17 TrebuchetMSItalic
1
57
18 TrebuchetMS,Italic
1
57
15 TrebuchetMSBold
1
58
16 TrebuchetMS,Bold
1
58
21 TrebuchetMSBoldItalic
1
59
22 TrebuchetMS,BoldItalic
1
59
13 VerdanaItalic
1
62
14 Verdana,Italic
1
62
11 VerdanaBold
1
63
12 Verdana,Bold
1
63
17 VerdanaBoldItalic
1
64
18 Verdana,BoldItalic
1
64
0 0 0 0 file_handle => 0x000000fc offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:47.643260 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:31:47.643260 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:31:47.693260 | LdrLoadDll |
basename => mscms module_address => 0x73b30000 flags => 0 module_name => mscms.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.693260 | NtOpenFile |
file_handle => 0x00000118 filepath => C:\WINDOWS\system32\spool\drivers\color\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.693260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Color\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Color\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.703260 | NtCreateFile |
create_disposition => 2 file_handle => 0x00000118 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.703260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.703260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst open_options => 2113600 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:47.703260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst open_options => 2113600 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:47.703260 | NtCreateFile |
create_disposition => 5 file_handle => 0x00000118 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\Adobe\Color\ACECache10.lst create_options => 96 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.703260 | LdrLoadDll |
basename => mscms module_address => 0x73b30000 flags => 0 module_name => mscms.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.703260 | NtOpenFile |
file_handle => 0x0000011c filepath => C:\WINDOWS\system32\spool\drivers\color\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.713260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000108 filepath => C:\WINDOWS\system32\spool\drivers\color\is330.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\is330.icm create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.713260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000108 filepath => C:\WINDOWS\system32\spool\drivers\color\kodak_dc.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\kodak_dc.icm create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.723260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000108 filepath => C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.723260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Color\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Color\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.723260 | NtWriteFile |
buffer => CPSA Ù jTdoogì C:\WINDOWS\System32\spool\DRIVERS\COLOR\is330.icm €sø’‘|ÿÿÿÿüÛ ˜ ‘| ( ! ‘|x = ‘|0  ´s
!¼c
0Ãœ ˜ ‘|@Š9 üÜ ! ‘|¸ 9 = ‘| HŠ9 sˆÜ éÂ|@ ‘|ÿÿÿÿ 2‘|c‘| ±—|@‘| èŽ ØÛ pÃœ ÀÜ éÂ|@ ‘|ÿÿÿÿ¤Ü † ˜ ‘|`3( xà Ø rncs BGR baL à TFSM| desc RICOH RUSSIAN-SC 040402 ÿþ R I C O H R U S S I A N - S C 0 4 0 4 0 2 RICOH RUSSIAN-SC 040402 ð8 doog) C:\WINDOWS\System32\spool\DRIVERS\COLOR\kodak_dc.icm sø’‘|ÿÿÿÿüÛ ˜ ‘| ( ! ‘|x = ‘|0  ´s
!¼c
0Ãœ ˜ ‘|@Š9 üÜ ! ‘|¸ 9 = ‘| HŠ9 sˆÜ éÂ|@ ‘|ÿÿÿÿ 2‘|c‘| ±—|@‘| èŽ ØÛ pÃœ ÀÜ éÂ|@ ‘|ÿÿÿÿ¤Ü † ˜ ‘|`3( xà Ø rtnm BGR baL ÃŽ 2 TFSM¹ desc KODAK DC Series Digital Camera þÿ K O D A K D C S e r i e s D i g i t a l C a m e r a KODAK DC Series Digital Camera ħ doogÃœ C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm ˜ ‘| ( ! ‘|x = ‘|0  ´s
!¼c
0Ãœ ˜ ‘|@Š9 üÜ ! ‘|¸ 9 = ‘| HŠ9 sˆÜ éÂ|@ ‘|ÿÿÿÿ 2‘|c‘| ±—|@‘| èŽ ØÛ pÃœ ÀÜ éÂ|@ ‘|ÿÿÿÿ¤Ü † ˜ ‘|`3( xà Ø rtnm BGR ZYX TRCÃŽ 1 TFSMl desc sRGB IEC61966-2.1 sRGB IEC61966-2.1 ?Ú.ÛJ‰«`¢<_|}Âà H file_handle => 0x00000118 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | CoInitializeSecurity | SUCCESS | ||||
| 2016-11-03 00:31:47.754260 | LdrLoadDll |
basename => OLE32 module_address => 0x774e0000 flags => 0 module_name => OLE32 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | LdrLoadDll |
basename => OLE32 module_address => 0x774e0000 flags => 0 module_name => OLE32.DLL |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.754260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.764260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.774260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.794260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.804260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.804260 | NtOpenFile |
file_handle => 0x00000134 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.844260 | LdrLoadDll |
basename => Annots.api module_address => 0x22100000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | LdrLoadDll |
basename => Comctl32 module_address => 0x773d0000 flags => 0 module_name => Comctl32.dll |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | LdrLoadDll |
basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll |
FAILURE | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | NtCreateFile |
create_disposition => 2 file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\OfflineDocs desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\OfflineDocs create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | NtOpenFile |
file_handle => 0x0000013c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.924260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\Workflows desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Collab\Workflows create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:47.934260 | CoInitializeEx |
options => 6 |
FAILURE | |||
| 2016-11-03 00:31:47.934260 | NtOpenFile |
file_handle => 0x00000144 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.934260 | NtOpenFile |
file_handle => 0x00000144 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.934260 | NtOpenFile |
file_handle => 0x00000144 filepath => C:\Documents and Settings\ardi\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.934260 | NtOpenFile |
file_handle => 0x00000144 filepath => C:\Documents and Settings\ardi\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:47.934260 | NtOpenFile |
file_handle => 0x00000144 filepath => C:\Documents and Settings\ardi\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:47.934260 | NtOpenFile |
file_handle => 0x00000144 filepath => C:\Documents and Settings\ardi\Application Data\desktop.ini desired_access => 0x80100000 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\desktop.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:47.934260 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:31:47.944260 | LdrLoadDll |
basename => AcroRd32.exe module_address => 0x00400000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe |
SUCCESS | |||
| 2016-11-03 00:31:47.944260 | LdrLoadDll |
basename => AcroRd32.exe module_address => 0x00400000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe |
SUCCESS | |||
| 2016-11-03 00:31:47.954260 | LdrLoadDll |
basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll |
FAILURE | |||
| 2016-11-03 00:31:47.954260 | NtOpenFile |
file_handle => 0x00000158 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:47.954260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000158 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\APT_ATT11990.pdf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\APT_ATT11990.pdf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.954260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000158 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\APT_ATT11990.pdf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\APT_ATT11990.pdf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:47.964260 | NtOpenFile |
file_handle => 0x00000158 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:47.984260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000160 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:48.004260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.004260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.124260 | LdrLoadDll |
basename => ADMPlugin.apl module_address => 0x04000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl |
SUCCESS | |||
| 2016-11-03 00:31:48.124260 | LdrLoadDll |
basename => ADMPlugin.apl module_address => 0x04000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl |
SUCCESS | |||
| 2016-11-03 00:31:48.124260 | LdrLoadDll |
basename => ADMPlugin.apl module_address => 0x04000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl |
SUCCESS | |||
| 2016-11-03 00:31:48.124260 | LdrLoadDll |
basename => UxTheme module_address => 0x5ad70000 flags => 0 module_name => UxTheme.dll |
SUCCESS | |||
| 2016-11-03 00:31:48.134260 | LdrLoadDll |
basename => uxTheme module_address => 0x5ad70000 flags => 0 module_name => uxTheme.dll |
SUCCESS | |||
| 2016-11-03 00:31:48.134260 | LdrLoadDll |
basename => Comctl32 module_address => 0x773d0000 flags => 0 module_name => Comctl32.dll |
SUCCESS | |||
| 2016-11-03 00:31:48.134260 | LdrLoadDll |
basename => Comctl32 module_address => 0x773d0000 flags => 0 module_name => Comctl32.dll |
SUCCESS | |||
| 2016-11-03 00:31:48.134260 | NtOpenFile |
file_handle => 0x00000168 filepath => C:\WINDOWS\system32 desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32 open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.164260 | CoCreateInstance |
class_context => 21 clsid => {b5f8350b-0548-48b1-a6ee-88bd00b4a5e7} iid => {6e26e776-04f0-495d-80e4-3330352e3169} |
SUCCESS | |||
| 2016-11-03 00:31:48.164260 | NtOpenFile |
file_handle => 0x000001dc filepath => C:\Documents and Settings\ardi\Local Settings\Temp desired_access => 0x00100020 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.184260 | LdrLoadDll |
basename => UxTheme module_address => 0x5ad70000 flags => 0 module_name => UxTheme.dll |
SUCCESS | |||
| 2016-11-03 00:31:48.214260 | LdrLoadDll |
basename => Msftedit module_address => 0x4b400000 flags => 0 module_name => Msftedit.dll |
SUCCESS | |||
| 2016-11-03 00:31:48.224260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001e8 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\APT_ATT11990.pdf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\APT_ATT11990.pdf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:48.294260 | LdrLoadDll |
basename => AcroForm.api module_address => 0x20800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api |
SUCCESS | |||
| 2016-11-03 00:31:48.334260 | LdrLoadDll |
basename => Comctl32 module_address => 0x773d0000 flags => 0 module_name => Comctl32.dll |
SUCCESS | |||
| 2016-11-03 00:31:48.334260 | LdrLoadDll |
basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll |
FAILURE | |||
| 2016-11-03 00:31:48.334260 | NtOpenFile |
file_handle => 0x000001ec filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.334260 | NtOpenFile |
file_handle => 0x000001ec filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.334260 | NtOpenFile |
file_handle => 0x000001ec filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.334260 | NtOpenFile |
file_handle => 0x000001ec filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.334260 | NtOpenFile |
file_handle => 0x000001ec filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.334260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:48.334260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:48.334260 | NtOpenFile |
file_handle => 0x000001ec filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.334260 | NtCreateFile |
create_disposition => 2 file_handle => 0x000001ec filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.334260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflow desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflow create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.334260 | NtOpenFile |
file_handle => 0x000001ec filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.334260 | NtOpenFile |
file_handle => 0x000001ec filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.344260 | NtOpenFile |
file_handle => 0x000001ec filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.344260 | NtOpenFile |
file_handle => 0x000001ec filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.344260 | NtOpenFile |
file_handle => 0x000001ec filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.344260 | NtOpenFile |
file_handle => 0x000001ec filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.344260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflowBackup desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflowBackup create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.344260 | LdrLoadDll |
basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll |
FAILURE | |||
| 2016-11-03 00:31:48.364260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.364260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.414260 | LdrLoadDll |
basename => EScript.api module_address => 0x23800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api |
SUCCESS | |||
| 2016-11-03 00:31:48.445260 | LdrLoadDll |
basename => ieframe module_address => 0x00000000 flags => 0 module_name => C:\WINDOWS\system32\ieframe.dll |
FAILURE | |||
| 2016-11-03 00:31:48.455260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.455260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.455260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.465260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.465260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.465260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.465260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\JSByteCodeWin.bin desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\JSByteCodeWin.bin create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.525260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.535260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.535260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.535260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.535260 | NtOpenFile |
file_handle => 0x000001f4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.595260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.595260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.605260 | LdrLoadDll |
basename => DigSig.api module_address => 0x23000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api |
SUCCESS | |||
| 2016-11-03 00:31:48.645260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.645260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AXE8SharedExpat.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.645260 | LdrLoadDll |
basename => AXE8SharedExpat module_address => 0x10000000 flags => 0 module_name => AXE8SharedExpat.dll |
SUCCESS | |||
| 2016-11-03 00:31:48.715260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AXSLE.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AXSLE.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.715260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\AXSLE.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\AXSLE.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.715260 | LdrLoadDll |
basename => AXSLE module_address => 0x02d30000 flags => 0 module_name => AXSLE.dll |
SUCCESS | |||
| 2016-11-03 00:31:48.745260 | NtOpenFile |
file_handle => 0x000001f8 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.745260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001f8 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.755260 | NtOpenFile |
file_handle => 0x000001f8 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.755260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001f8 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:48.825260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.825260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.825260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001fc filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.825260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000001fc filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.835260 | LdrLoadDll |
basename => cryptocme2 module_address => 0x04930000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.dll |
SUCCESS | |||
| 2016-11-03 00:31:48.895260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.895260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:48.895260 | LdrLoadDll |
basename => ccme_base module_address => 0x049e0000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll |
SUCCESS | |||
| 2016-11-03 00:31:48.895260 | LdrLoadDll |
basename => cryptocme2 module_address => 0x04930000 flags => 0 module_name => .\cryptocme2.dll |
SUCCESS | |||
| 2016-11-03 00:31:48.895260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\cryptocme2.sig create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.895260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_base.dll create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:48.905260 | LdrLoadDll |
basename => ccme_base module_address => 0x049e0000 flags => 0 module_name => .\ccme_base.dll |
SUCCESS | |||
| 2016-11-03 00:31:48.925260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\entropy desired_access => 0x80100080 file_attributes => 128 filepath_r => entropy create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:49.005260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_ecc.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_ecc.dll create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:49.005260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ccme_eccaccel.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ccme_eccaccel.dll create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:49.005260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.005260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.005260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.005260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.095260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.095260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.095260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.095260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.095260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.095260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.105260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.105260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.105260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.105260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.105260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.105260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.105260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.105260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.105260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.105260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.115260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.115260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.115260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.115260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.126260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.126260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.126260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.126260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.126260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.126260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.126260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.126260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.136260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.136260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.136260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.136260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.166260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.166260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.176260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.176260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.206260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.206260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.206260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.206260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.206260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.206260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.206260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.206260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.266260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.266260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.266260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.266260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.266260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.266260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.276260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.276260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.276260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.276260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.276260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.276260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.286260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.286260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.286260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.286260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.286260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.286260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.286260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.286260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.286260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.286260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.286260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.286260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.296260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.296260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.296260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.296260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.296260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.296260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.296260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.296260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.296260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.296260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.306260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.306260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.306260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.306260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.306260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.306260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.336260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.336260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.336260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.336260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.336260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.336260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.336260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.336260 | LdrLoadDll |
basename => AcroForm.api module_address => 0x20800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api |
SUCCESS | |||
| 2016-11-03 00:31:49.336260 | LdrLoadDll |
basename => AcroForm.api module_address => 0x20800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | LdrLoadDll |
basename => AcroForm.api module_address => 0x20800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Checkers.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | LdrLoadDll |
basename => DigSig.api module_address => 0x23000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | LdrLoadDll |
basename => DigSig.api module_address => 0x23000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | LdrLoadDll |
basename => DigSig.api module_address => 0x23000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DVA.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\eBook.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\IA32.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.346260 | LdrLoadDll |
basename => EScript.api module_address => 0x23800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api |
SUCCESS | |||
| 2016-11-03 00:31:49.356260 | LdrLoadDll |
basename => EScript.api module_address => 0x23800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api |
SUCCESS | |||
| 2016-11-03 00:31:49.356260 | LdrLoadDll |
basename => EScript.api module_address => 0x23800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\HLS.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Multimedia.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PDDom.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.366260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ReadOutLoud.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\reflow.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SaveAsRTF.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Search5.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.376260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Spelling.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x00100020 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api open_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\weblink.api create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | LdrLoadDll |
basename => Annots.api module_address => 0x22100000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | LdrLoadDll |
basename => Annots.api module_address => 0x22100000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | LdrLoadDll |
basename => Annots.api module_address => 0x22100000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api |
SUCCESS | |||
| 2016-11-03 00:31:49.386260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.406260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.406260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.406260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.406260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.406260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.406260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.416260 | LdrLoadDll |
basename => PPKLite.api module_address => 0x28000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api |
SUCCESS | |||
| 2016-11-03 00:31:49.416260 | NtOpenFile |
file_handle => 0x00000204 filepath => C:\Documents and Settings\ardi\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.416260 | NtOpenFile |
file_handle => 0x00000204 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.416260 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:31:49.416260 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:31:49.416260 | NtCreateFile |
create_disposition => 5 file_handle => 0x00000204 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\A9R885D.tmp desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\A9R885D.tmp create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:31:49.416260 | NtWriteFile |
buffer => %PDF-1.6
%âãÃÓ
1 0 obj
<</Pages 2 0 R/Type/Catalog>>
endobj
2 0 obj
<</Count 0/Kids[]/Type/Pages>>
endobj
3 0 obj
<<>>
endobj
xref
0 4
0000000000 65535 f
0000000016 00000 n
0000000061 00000 n
0000000107 00000 n
trailer
<</Size 4/Root 1 0 R/Info 3 0 R/ID[<B8C78591C8FFF14E99E88F3340890501><B8C78591C8FFF14E99E88F3340890501>]>>
startxref
127
%%EOF
file_handle => 0x00000204 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:49.416260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000204 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\A9R885D.tmp desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\A9R885D.tmp create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.416260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.416260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.426260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:49.426260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.426260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.426260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.426260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.426260 | LdrLoadDll |
basename => icuuc36 module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\icuuc36.dll |
FAILURE | |||
| 2016-11-03 00:31:49.426260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.426260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.426260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:49.426260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:49.436260 | LdrLoadDll |
basename => icucnv36 module_address => 0x4a800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\icucnv36.dll |
SUCCESS | |||
| 2016-11-03 00:31:49.436260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.436260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.436260 | LdrLoadDll |
basename => icudt36_cjk module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\icudt36_cjk.dll |
FAILURE | |||
| 2016-11-03 00:31:49.436260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.436260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.436260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.436260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.436260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.436260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.456260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.456260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\SY______.PFB create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.456260 | NtOpenFile |
file_handle => 0x00000200 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.456260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000200 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\pfm\SY______.PFM create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.456260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.456260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\AdobePiStd.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.466260 | LdrLoadDll |
basename => ATMLIB module_address => 0x73c20000 flags => 0 module_name => ATMLIB.dll |
SUCCESS | |||
| 2016-11-03 00:31:49.466260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:49.466260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.466260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.466260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.466260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.466260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MinionPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadCurrency-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtOpenFile |
file_handle => 0x0000010c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000010c filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\MyriadPro-Regular.otf create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:49.476260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:49.476260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:49.476260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:49.476260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:49.486260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:49.486260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:49.486260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:49.486260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:49.486260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\ATMREG.ATM desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\ATMREG.ATM create_options => 2144 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:49.516260 | LdrLoadDll |
basename => mscms module_address => 0x73b30000 flags => 0 module_name => mscms.dll |
SUCCESS | |||
| 2016-11-03 00:31:49.516260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000021c filepath => C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm create_options => 2144 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.516260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000021c filepath => C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.526260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.536260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.536260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.536260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.536260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:49.536260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\All Users\Application Data\Adobe\Acrobat\9.0\Replicate\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.167260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\rt3d.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\rt3d.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.167260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\rt3d.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\rt3d.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.167260 | LdrLoadDll |
basename => rt3d module_address => 0x24d80000 flags => 0 module_name => rt3d.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.167260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\WINDOWS\system32 desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32 open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.197260 | LdrLoadDll |
basename => D3D8 module_address => 0x6d9a0000 flags => 0 module_name => D3D8.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.207260 | LdrLoadDll |
basename => D3D9 module_address => 0x4fdd0000 flags => 0 module_name => D3D9.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.207260 | NtOpenFile |
file_handle => 0x000001dc filepath => C:\Documents and Settings\ardi\Local Settings\Temp desired_access => 0x00100020 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.207260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.englanguage.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.englanguage.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.217260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\$cache$.$p$ desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\$cache$.$p$ create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.217260 | NtOpenFile |
file_handle => 0x0000021c filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.257260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.257260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.257260 | LdrLoadDll |
basename => 2d.x3d module_address => 0x04860000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\2d.x3d |
SUCCESS | |||
| 2016-11-03 00:31:50.257260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.eng2d.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.eng2d.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.267260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.267260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.267260 | LdrLoadDll |
basename => 3difr.x3d module_address => 0x04f70000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\3difr.x3d |
SUCCESS | |||
| 2016-11-03 00:31:50.277260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.eng3difr.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.eng3difr.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.297260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.297260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.297260 | LdrLoadDll |
basename => drvDX9.x3d module_address => 0x25600000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX9.x3d |
SUCCESS | |||
| 2016-11-03 00:31:50.297260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.engdrvDX9.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.engdrvDX9.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.327260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.327260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.327260 | LdrLoadDll |
basename => drvSOFT.x3d module_address => 0x04fc0000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d |
SUCCESS | |||
| 2016-11-03 00:31:50.327260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.engdrvSOFT.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.engdrvSOFT.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.337260 | LdrLoadDll |
basename => MSVFW32 module_address => 0x75a70000 flags => 0 module_name => MSVFW32.DLL |
SUCCESS | |||
| 2016-11-03 00:31:50.367260 | LdrLoadDll |
basename => DCIMAN32 module_address => 0x73bc0000 flags => 0 module_name => DCIMAN32.DLL |
SUCCESS | |||
| 2016-11-03 00:31:50.437260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.437260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.447260 | LdrLoadDll |
basename => prcr.x3d module_address => 0x25790000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d |
SUCCESS | |||
| 2016-11-03 00:31:50.447260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.engprcr.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.engprcr.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.457260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.457260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.457260 | LdrLoadDll |
basename => tesselate.x3d module_address => 0x03ff0000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d |
SUCCESS | |||
| 2016-11-03 00:31:50.457260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\language.engtesselate.ln desired_access => 0x80100080 file_attributes => 0 filepath_r => language.engtesselate.ln create_options => 96 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.457260 | NtOpenFile |
file_handle => 0x0000023c filepath => C:\WINDOWS\system32 desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32 open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.457260 | LdrLoadDll |
basename => d3d9 module_address => 0x4fdd0000 flags => 0 module_name => d3d9.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.457260 | NtOpenFile |
file_handle => 0x00000248 filepath => C:\Documents and Settings\ardi\Local Settings\Temp desired_access => 0x00100020 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.457260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000023c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.457260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000024c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.457260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000023c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.467260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000024c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.467260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.467260 | LdrLoadDll |
basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => SHELL32.DLL |
SUCCESS | |||
| 2016-11-03 00:31:50.467260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\d3d9caps.dat create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.477260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000023c filepath => C:\WINDOWS\Web\wallpaper\Bliss.bmp desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\web\wallpaper\Bliss.bmp create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:50.508260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000023c filepath => C:\WINDOWS\Web\wallpaper\Bliss.bmp desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\web\wallpaper\Bliss.bmp create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:50.538260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000023c filepath => C:\WINDOWS\Web\wallpaper\Bliss.bmp desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\web\wallpaper\Bliss.bmp create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:50.558260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000023c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.558260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000024c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.558260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.558260 | LdrLoadDll |
basename => SHELL32 module_address => 0x7c9c0000 flags => 0 module_name => SHELL32.DLL |
SUCCESS | |||
| 2016-11-03 00:31:50.558260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Application Data\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Application Data\d3d9caps.dat create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.558260 | NtCreateFile |
create_disposition => 5 file_handle => 0x0000023c filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 2 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:50.558260 | NtWriteFile |
buffer => file_handle => 0x0000023c offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:50.568260 | NtWriteFile |
buffer => î€ ï¾ | file_handle => 0x0000023c offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:50.568260 | NtWriteFile |
buffer => | ƒ 0á èõ4Ҏ·×¯ýÃC ¯ÂÈ5 ÿÿ ÿÿ ÿ þÿ ÿÿ €? € à < x“ ¤ file_handle => 0x0000023c offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:50.568260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000023c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.568260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000024c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.568260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000023c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.568260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000024c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.568260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000023c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.568260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000024c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.568260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000023c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.568260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000024c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.568260 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:31:50.718260 | CoCreateInstance |
class_context => 4 clsid => {b22d0c7b-1e65-4533-97fa-a7335b8bcd94} iid => {8ca6c1bb-be62-4739-80ab-d5ecc7605358} |
SUCCESS | |||
| 2016-11-03 00:31:50.718260 | LdrLoadDll |
basename => OLEAUT32 module_address => 0x77120000 flags => 0 module_name => OLEAUT32 |
SUCCESS | |||
| 2016-11-03 00:31:50.718260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000274 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.718260 | NtWriteFile |
buffer => H ¸¸ xW44ëï #Eg‰« ]ˆŠë ɟè +H` file_handle => 0x00000274 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtOpenFile |
file_handle => 0x0000026c filepath => C:\WINDOWS\system32 desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32 open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | LdrLoadDll |
basename => D3D9 module_address => 0x4fdd0000 flags => 0 module_name => D3D9.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtOpenFile |
file_handle => 0x00000248 filepath => C:\Documents and Settings\ardi\Local Settings\Temp desired_access => 0x00100020 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000270 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000270 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000270 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000270 filepath => C:\WINDOWS\system32\VBoxDisp.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\VBoxDisp.dll create_options => 96 status_info => 1 share_access => 5 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000026c filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtCreateFile |
create_disposition => 5 file_handle => 0x00000270 filepath => C:\WINDOWS\system32\d3d9caps.tmp desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.tmp create_options => 96 status_info => 2 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtWriteFile |
buffer => file_handle => 0x00000270 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtWriteFile |
buffer => î€ ï¾ | file_handle => 0x00000270 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtWriteFile |
buffer => | ƒ 0á èõ4Ҏ·×¯ýÃC ¯ÂÈ5 ÿÿ ÿÿ ÿ þÿ ÿÿ €? P Â… < PD ¤ file_handle => 0x00000270 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtOpenFile |
file_handle => 0x0000026c filepath => C:\WINDOWS\system32\d3d9caps.dat desired_access => 0x00010080 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.dat open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:50.728260 | NtOpenFile |
file_handle => 0x0000026c filepath => C:\WINDOWS\system32\d3d9caps.tmp desired_access => 0x00110080 filepath_r => \??\C:\WINDOWS\system32\d3d9caps.tmp open_options => 2113568 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:50.738260 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.738260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.738260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.748260 | NtOpenFile |
file_handle => 0x00000288 filepath => C:\WINDOWS\system32\urlmon.dll desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\urlmon.dll open_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:50.748260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\WINDOWS\system32\urlmon.dll.123.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\urlmon.dll.123.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.748260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\WINDOWS\system32\urlmon.dll.123.Config desired_access => 0x001200a9 filepath_r => \??\C:\WINDOWS\system32\urlmon.dll.123.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.748260 | LdrLoadDll |
basename => comctl32 module_address => 0x773d0000 flags => 0 module_name => comctl32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.748260 | LdrLoadDll |
basename => DSOUND module_address => 0x73f10000 flags => 0 module_name => C:\WINDOWS\system32\DSOUND.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.818260 | LdrLoadDll |
basename => dbghelp module_address => 0x59a60000 flags => 0 module_name => dbghelp.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.828260 | LdrLoadDll |
basename => authplay module_address => 0x30000000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\authplay.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.828260 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:31:50.838260 | CoCreateInstance |
class_context => 3 clsid => {275c23e2-3747-11d0-9fea-00aa003f8646} iid => {275c23e1-3747-11d0-9fea-00aa003f8646} |
SUCCESS | |||
| 2016-11-03 00:31:50.838260 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.838260 | LdrLoadDll |
basename => user32 module_address => 0x7e410000 flags => 0 module_name => user32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.838260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.838260 | LdrLoadDll |
basename => version module_address => 0x77c00000 flags => 0 module_name => version.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.838260 | NtOpenFile |
file_handle => 0x00000288 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.838260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\ss.sgn desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ss.sgn create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:50.848260 | NtOpenFile |
file_handle => 0x00000288 filepath => C:\WINDOWS\system32\Macromed\Flash\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.848260 | NtOpenFile |
file_handle => 0x00000288 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.848260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\ss.cfg desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ss.cfg create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:50.848260 | NtOpenFile |
file_handle => 0x00000288 filepath => C:\WINDOWS\system32\Macromed\Flash\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.848260 | NtOpenFile |
file_handle => 0x00000288 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.848260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\ss.sgn desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ss.sgn create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:50.848260 | NtOpenFile |
file_handle => 0x00000288 filepath => C:\WINDOWS\system32\Macromed\Flash\ desired_access => 0x00100001 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.848260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\mms.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\mms.cfg create_options => 100 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.848260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\mms.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\mms.cfg create_options => 100 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.848260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\mms.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\mms.cfg create_options => 100 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.848260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\mms.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\mms.cfg create_options => 100 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.848260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\oem.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\oem.cfg create_options => 100 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.848260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\Macromed\Flash\oem.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\Macromed\Flash\oem.cfg create_options => 100 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.848260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\oem.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\oem.cfg create_options => 100 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.848260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\WINDOWS\system32\oem.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\oem.cfg create_options => 100 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.848260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\mm.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\mm.cfg create_options => 100 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:50.848260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\mm.cfg desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\mm.cfg create_options => 100 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.848260 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.848260 | LdrLoadDll |
basename => user32 module_address => 0x7e410000 flags => 0 module_name => user32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.848260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.848260 | LdrLoadDll |
basename => version module_address => 0x77c00000 flags => 0 module_name => version.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.888260 | LdrLoadDll |
basename => kernel32 module_address => 0x7c800000 flags => 0 module_name => kernel32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.898260 | LdrLoadDll |
basename => user32 module_address => 0x7e410000 flags => 0 module_name => user32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.898260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.898260 | LdrLoadDll |
basename => version module_address => 0x77c00000 flags => 0 module_name => version.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.918260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:50.928260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:50.928260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:50.928260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:50.928260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtCreateFile |
create_disposition => 2 file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:50.928260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtCreateFile |
create_disposition => 2 file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:50.928260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | LdrLoadDll |
basename => advapi32 module_address => 0x77dd0000 flags => 0 module_name => advapi32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000002a8 filepath => C:\WINDOWS\system32\rsaenh.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\rsaenh.dll create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000002a8 filepath => C:\WINDOWS\system32\rsaenh.dll desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\rsaenh.dll create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | LdrLoadDll |
basename => crypt32 module_address => 0x77a80000 flags => 0 module_name => crypt32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000002ac filepath => C:\WINDOWS\system32\rsaenh.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\rsaenh.dll create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.928260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000002ac filepath => C:\WINDOWS\system32\rsaenh.dll desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\WINDOWS\system32\rsaenh.dll create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.958260 | LdrLoadDll |
basename => rsaenh module_address => 0x68000000 flags => 0 module_name => rsaenh.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.958260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.958260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\8NAEU6ZN desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\8NAEU6ZN create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:50.958260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.958260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.958260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:50.958260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.958260 | NtCreateFile |
create_disposition => 2 file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\8NAEU6ZN desired_access => 0x00100001 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\8NAEU6ZN create_options => 16417 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.958260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.958260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\8NAEU6ZN desired_access => 0x00100080 file_attributes => 0 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\8NAEU6ZN create_options => 96 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:50.958260 | NtOpenFile |
file_handle => 0x000002a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Flash Player\AssetCache\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.988260 | LdrLoadDll |
basename => WINMM module_address => 0x76b40000 flags => 0 module_name => C:\WINDOWS\system32\WINMM.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.988260 | LdrLoadDll |
basename => Secur32 module_address => 0x77fe0000 flags => 0 module_name => Secur32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.988260 | LdrLoadDll |
basename => crypt32 module_address => 0x77a80000 flags => 0 module_name => crypt32.dll |
SUCCESS | |||
| 2016-11-03 00:31:50.988260 | NtOpenFile |
file_handle => 0x000002c4 filepath => C:\WINDOWS\system32 desired_access => 0x00100020 filepath_r => \??\C:\WINDOWS\system32 open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:50.998260 | LdrLoadDll |
basename => schannel module_address => 0x767f0000 flags => 0 module_name => C:\WINDOWS\system32\schannel.dll |
SUCCESS | |||
| 2016-11-03 00:31:51.008260 | NtOpenFile |
file_handle => 0x0000030c filepath => C:\Documents and Settings\ardi\Local Settings\Temp desired_access => 0x00100020 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp open_options => 33 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.028260 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:31:51.028260 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:31:51.028260 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:31:51.028260 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:31:51.028260 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:31:51.028260 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:31:51.028260 | LdrLoadDll |
basename => OLEAUT32 module_address => 0x77120000 flags => 0 module_name => OLEAUT32.dll |
SUCCESS | |||
| 2016-11-03 00:31:51.028260 | NtOpenFile |
file_handle => 0x00000318 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.028260 | NtOpenFile |
file_handle => 0x00000318 filepath => C:\Documents and Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.028260 | NtOpenFile |
file_handle => 0x00000318 filepath => C:\Documents and Settings\ardi\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.028260 | NtOpenFile |
file_handle => 0x00000318 filepath => C:\Documents and Settings\ardi\Local Settings\ desired_access => 0x00100001 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.038260 | NtOpenFile |
file_handle => 0x0000031c filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.038260 | NtOpenFile |
file_handle => 0x0000031c filepath => C:\Documents and Settings\ardi\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.038260 | NtOpenFile |
file_handle => 0x0000031c filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Local Settings\Temp\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.038260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:51.038260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000033c filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:51.038260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:51.038260 | NtCreateFile |
create_disposition => 1 file_handle => 0x0000033c filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:51.038260 | LdrLoadDll |
basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv |
SUCCESS | |||
| 2016-11-03 00:31:51.038260 | LdrLoadDll |
basename => setupapi module_address => 0x77920000 flags => 0 module_name => setupapi.dll |
SUCCESS | |||
| 2016-11-03 00:31:51.038260 | LdrLoadDll |
basename => WINTRUST module_address => 0x76c30000 flags => 0 module_name => WINTRUST.dll |
SUCCESS | |||
| 2016-11-03 00:31:51.038260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000340 filepath => \\?\root#system#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}\{cd171de3-69e5-11d2-b56d-0000f8754380}&{9b365890-165f-11d0-a195-0020afd156e4} desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\root#system#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}\{cd171de3-69e5-11d2-b56d-0000f8754380}&{9b365890-165f-11d0-a195-0020afd156e4} create_options => 64 status_info => 0 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:31:51.038260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:51.038260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000334 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:51.038260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000334 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:51.048260 | LdrLoadDll |
basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv |
SUCCESS | |||
| 2016-11-03 00:31:51.048260 | LdrLoadDll |
basename => setupapi module_address => 0x77920000 flags => 0 module_name => setupapi.dll |
SUCCESS | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000338 filepath => \\?\root#system#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}\{cd171de3-69e5-11d2-b56d-0000f8754380}&{9b365890-165f-11d0-a195-0020afd156e4} desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\root#system#0000#{3e227e76-690d-11d2-8161-0000f8775bf1}\{cd171de3-69e5-11d2-b56d-0000f8754380}&{9b365890-165f-11d0-a195-0020afd156e4} create_options => 64 status_info => 0 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000364 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000364 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:51.048260 | LdrLoadDll |
basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv |
SUCCESS | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000364 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000364 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:51.048260 | LdrLoadDll |
basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv |
SUCCESS | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000364 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => wdmaud.drv create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:51.048260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000364 filepath => C:\WINDOWS\system32\wdmaud.drv desired_access => 0x00100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\system32\wdmaud.drv create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:51.048260 | LdrLoadDll |
basename => wdmaud.drv module_address => 0x72d20000 flags => 0 module_name => wdmaud.drv |
SUCCESS | |||
| 2016-11-03 00:31:51.138260 | LdrLoadDll |
basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv |
SUCCESS | |||
| 2016-11-03 00:31:51.138260 | LdrLoadDll |
basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv |
SUCCESS | |||
| 2016-11-03 00:31:51.138260 | LdrLoadDll |
basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv |
SUCCESS | |||
| 2016-11-03 00:31:51.138260 | LdrLoadDll |
basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv |
SUCCESS | |||
| 2016-11-03 00:31:51.138260 | LdrLoadDll |
basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv |
SUCCESS | |||
| 2016-11-03 00:31:51.138260 | LdrLoadDll |
basename => msacm32.drv module_address => 0x72d10000 flags => 0 module_name => msacm32.drv |
SUCCESS | |||
| 2016-11-03 00:31:51.138260 | LdrLoadDll |
basename => midimap module_address => 0x77bd0000 flags => 0 module_name => midimap.dll |
SUCCESS | |||
| 2016-11-03 00:31:51.138260 | LdrLoadDll |
basename => midimap module_address => 0x77bd0000 flags => 0 module_name => midimap.dll |
SUCCESS | |||
| 2016-11-03 00:31:51.138260 | LdrLoadDll |
basename => midimap module_address => 0x77bd0000 flags => 0 module_name => midimap.dll |
SUCCESS | |||
| 2016-11-03 00:31:51.148260 | LdrLoadDll |
basename => midimap module_address => 0x77bd0000 flags => 0 module_name => midimap.dll |
SUCCESS | |||
| 2016-11-03 00:31:51.229260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\BIBUtils.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\BIBUtils.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:51.229260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\BIBUtils.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\BIBUtils.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:51.239260 | LdrLoadDll |
basename => BIBUtils module_address => 0x07f80000 flags => 0 module_name => BIBUtils.dll |
SUCCESS | |||
| 2016-11-03 00:31:51.249260 | NtOpenFile |
file_handle => 0x00000380 filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.249260 | NtOpenFile |
file_handle => 0x00000380 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.249260 | NtOpenFile |
file_handle => 0x00000380 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.249260 | NtOpenFile |
file_handle => 0x00000380 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.249260 | NtOpenFile |
file_handle => 0x00000380 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.249260 | NtOpenFile |
file_handle => 0x00000380 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:51.249260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflowBackup desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\Forms\AdhocWorkflowBackup create_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:53.181260 | NtOpenFile |
file_handle => 0x0000038c filepath => C:\Documents and Settings\ardi\Application Data\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.181260 | NtOpenFile |
file_handle => 0x0000038c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.181260 | NtOpenFile |
file_handle => 0x0000038c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.181260 | NtOpenFile |
file_handle => 0x0000038c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.181260 | NtOpenFile |
file_handle => 0x0000038c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.181260 | NtOpenFile |
file_handle => 0x0000038c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.181260 | NtOpenFile |
file_handle => 0x0000038c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.181260 | NtOpenFile |
file_handle => 0x0000038c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.181260 | NtOpenFile |
file_handle => 0x0000038c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.181260 | NtOpenFile |
file_handle => 0x0000038c filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.181260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:53.181260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:31:53.191260 | LdrLoadDll |
basename => sqlite module_address => 0x07fb0000 flags => 0 module_name => sqlite.dll |
SUCCESS | |||
| 2016-11-03 00:31:53.191260 | NtCreateFile |
create_disposition => 3 file_handle => 0x00000390 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 2 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.191260 | NtCreateFile |
create_disposition => 3 file_handle => 0x00000394 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.191260 | NtWriteFile |
buffer => ÙÕù ¡c× ×‰ ¦ file_handle => 0x00000394 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.191260 | NtWriteFile |
buffer => file_handle => 0x00000394 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.191260 | NtWriteFile |
buffer => SQLite format 3 @
€ ì€ j''Âtableversion_tableversion_tableCREATE TABLE version_table ( version INTEGER NOT NULL PRIMARY KEY )‚##ƒitablepref_eventspref_eventsCREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL ) file_handle => 0x00000390 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.191260 | NtWriteFile |
buffer =>
file_handle => 0x00000390 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.191260 | NtWriteFile |
buffer =>
ü ü file_handle => 0x00000390 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtOpenFile |
file_handle => 0x00000394 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtOpenFile |
file_handle => 0x000003a0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | CoInitializeEx |
options => 2 |
FAILURE | |||
| 2016-11-03 00:31:53.201260 | CoUninitialize | SUCCESS | ||||
| 2016-11-03 00:31:53.201260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtOpenFile |
file_handle => 0x000003a8 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtOpenFile |
file_handle => 0x000003a8 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16385 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003ac filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtWriteFile |
buffer => ÙÕù ¡c× c,Âh file_handle => 0x000003ac offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtWriteFile |
buffer => file_handle => 0x000003ac offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtWriteFile |
buffer =>
file_handle => 0x000003ac offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtWriteFile |
buffer => c,Âh file_handle => 0x000003ac offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtWriteFile |
buffer => file_handle => 0x000003ac offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtWriteFile |
buffer => SQLite format 3 @
€ ì€ j''Âtableversion_tableversion_tableCREATE TABLE version_table ( version INTEGER NOT NULL PRIMARY KEY )‚##ƒitablepref_eventspref_eventsCREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL ) file_handle => 0x000003ac offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.201260 | NtWriteFile |
buffer => c,ÂÂ file_handle => 0x000003ac offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtOpenFile |
file_handle => 0x000003b0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtWriteFile |
buffer => file_handle => 0x000003ac offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtOpenFile |
file_handle => 0x000003b0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtWriteFile |
buffer => SQLite format 3 @
€ ì€ j''Âtableversion_tableversion_tableCREATE TABLE version_table ( version INTEGER NOT NULL PRIMARY KEY )‚##ƒitablepref_eventspref_eventsCREATE TABLE pref_events (event_id INTEGER NOT NULL PRIMARY KEY, event_time INTEGER NOT NULL, instance_guid TEXT NOT NULL, section_name TEXT NOT NULL, pref_key TEXT, pref_value TEXT, client_nonce INTEGER NOT NULL, added INTEGER NOT NULL ) file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtWriteFile |
buffer =>
¸ ¸ F M ) X# deaff6fd27f71340a75b7692dc0210ceAVGeneralLastExitNormal file_handle => 0x000003a4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtOpenFile |
file_handle => 0x000003b0 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtOpenFile |
file_handle => 0x000003ac filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003ac filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtWriteFile |
buffer => ÙÕù ¡c× ®>¹ file_handle => 0x000003ac offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtOpenFile |
file_handle => 0x000003ac filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003ac filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.211260 | NtWriteFile |
buffer => ÙÕù ¡c× ›¶é file_handle => 0x000003ac offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003ac filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003ac filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003ac filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtWriteFile |
buffer => ÙÕù ¡c× ëfþ4 file_handle => 0x000003ac offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003ac filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtCreateFile |
create_disposition => 3 file_handle => 0x000003ac filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0xc0100080 file_attributes => 128 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal create_options => 96 status_info => 2 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtWriteFile |
buffer => ÙÕù ¡c× ¼ûŸË file_handle => 0x000003ac offset => 0 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003b4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003b4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003ac filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal desired_access => 0x00010080 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\SharedDataEvents-journal open_options => 2113600 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.221260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.332260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ desired_access => 0x00100001 filepath_r => \??\C:\Documents and Settings\ardi\Application Data\Adobe\Acrobat\9.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.332260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.332260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.332260 | NtOpenFile |
file_handle => 0x000003a4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\JavaScripts\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:53.492260 | LdrLoadDll |
basename => Wtsapi32 module_address => 0x76f50000 flags => 0 module_name => Wtsapi32.dll |
SUCCESS | |||
| 2016-11-03 00:31:53.812260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000003b4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\EScript.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:53.892260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000003b4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\PPKLite.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:54.083260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000003b4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Annots.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:54.213260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000003b4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:54.483260 | NtCreateFile |
create_disposition => 1 file_handle => 0x000003b4 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\AcroForm.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x000003b4 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap open_options => 16385 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x000003bc filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont open_options => 16385 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x000003b8 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x000003bc filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font open_options => 16385 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x000003c4 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x000003c4 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\Font\PFM\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CIDFont\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts open_options => 16385 status_info => 4294967295 share_access => 7 |
FAILURE | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x000003c0 filepath => C:\Program Files\Common Files\Adobe\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x000003c4 filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap open_options => 16385 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | LdrLoadDll |
basename => shell32 module_address => 0x7c9c0000 flags => 0 module_name => shell32.dll |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x000003cc filepath => C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Resource\CMap\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:31:56.045260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Common Files\Adobe\Fonts\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\Fonts\ open_options => 16417 status_info => 4294967295 share_access => 3 |
FAILURE | |||
| 2016-11-03 00:32:02.765260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.2.Manifest desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.2.Manifest open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:32:02.765260 | NtOpenFile |
file_handle => 0x00000000 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.2.Config desired_access => 0x001200a9 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api.2.Config open_options => 96 status_info => 4294967295 share_access => 1 |
FAILURE | |||
| 2016-11-03 00:32:02.775260 | LdrLoadDll |
basename => Updater.api module_address => 0x30800000 flags => 0 module_name => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api |
SUCCESS | |||
| 2016-11-03 00:32:02.785260 | NtOpenFile |
file_handle => 0x000003c8 filepath => C:\Program Files\Common Files\Adobe\ARM\1.0\ desired_access => 0x00100001 filepath_r => \??\C:\Program Files\Common Files\Adobe\ARM\1.0\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:32:02.825260 | CreateProcessInternalW |
thread_identifier => 1064 thread_handle => 0x00000408 process_identifier => 1488 current_directory => C:\Documents and Settings\ardi\Local Settings\Temp filepath => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe track => 1 command_line => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:9.0 /MODE:2 filepath_r => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe creation_flags => 67109904 process_handle => 0x00000404 inherit_handles => 0 |
SUCCESS | |||
| 2016-11-03 00:32:02.825260 | ShellExecuteExW |
parameters => /PRODUCT:Reader /VERSION:9.0 /MODE:2 filepath => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" filepath_r => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" show_type => 10 |
SUCCESS | |||
| 2016-11-03 00:32:03.316260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000408 filepath => C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api desired_access => 0x80100080 file_attributes => 0 filepath_r => \??\C:\Program Files\Adobe\Reader 9.0\Reader\plug_ins\Updater.api create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:32:12.369260 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000404 filepath => C:\WINDOWS\system32\spool\drivers\color\sRGB Color Space Profile.icm desired_access => 0x80100080 file_attributes => 128 filepath_r => \??\C:\WINDOWS\System32\spool\DRIVERS\COLOR\sRGB Color Space Profile.icm create_options => 96 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:32:47.750260 | NtDelayExecution |
skipped => 0 milliseconds => 60000 |
SUCCESS | |||
| 2016-11-03 00:33:19.626260 | LdrLoadDll |
basename => msimg32 module_address => 0x76380000 flags => 0 module_name => msimg32.dll |
SUCCESS |
AdobeARM.exe PID: 1488, Parent PID: 988
| Timestamp | Thread | Function | Arguments | Status | Return | Repeated |
|---|---|---|---|---|---|---|
| 2016-11-03 00:32:04.318977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.318977 | NtQuerySystemInformation |
information_class => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00bb0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 8192 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb1000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x004549b4 function_name => FlsAlloc |
FAILURE | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x004549a8 function_name => FlsGetValue |
FAILURE | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x0045499c function_name => FlsSetValue |
FAILURE | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x00454994 function_name => FlsFree |
FAILURE | |||
| 2016-11-03 00:32:04.318977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c913405 function_name => DecodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c913405 function_name => DecodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c913405 function_name => DecodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb3000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c80aeba function_name => IsProcessorFeaturePresent |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | SetUnhandledExceptionFilter | SUCCESS | ||||
| 2016-11-03 00:32:04.318977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 524288 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00bc0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bc0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 12288 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb4000 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | GetSystemMetrics |
index => 11 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | GetSystemMetrics |
index => 12 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | GetSystemMetrics |
index => 2 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | GetSystemMetrics |
index => 3 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | GetCursorPos |
y => 274 x => 22 |
SUCCESS | |||
| 2016-11-03 00:32:04.318977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.318977 | RegCloseKey |
key_handle => 0x00000000 |
FAILURE | |||
| 2016-11-03 00:32:04.328977 | NtOpenFile |
file_handle => 0x00000094 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | NtQueryInformationFile |
file_handle => 0x00000094 information_class => 9 |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | NtClose |
handle => 0x00000094 |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | SetErrorMode |
mode => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | SetErrorMode |
mode => 32775 |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8154ec function_name => CreateActCtxW |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130ef function_name => ReleaseActCtx |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c80a6d4 function_name => ActivateActCtx |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c80a705 function_name => DeactivateActCtx |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | CreateActCtxW |
application_name => .nls module_handle => 0x00400000 resource_name => |
FAILURE | |||
| 2016-11-03 00:32:04.328977 | CreateActCtxW |
application_name => .nls module_handle => 0x00400000 resource_name => |
FAILURE | |||
| 2016-11-03 00:32:04.328977 | CreateActCtxW |
application_name => .nls module_handle => 0x00400000 resource_name => |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | FindResourceW |
module_handle => 0x00400000 name => #3585 type => #6 |
FAILURE | |||
| 2016-11-03 00:32:04.328977 | SetWindowsHookExW |
thread_identifier => 1064 callback_function => 0x00425fb1 module_address => 0x00000000 hook_identifier => 4294967295 |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | LdrGetDllHandle |
module_name => user32.dll module_address => 0x7e410000 |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | LdrGetProcedureAddress |
ordinal => 0 module => USER32 module_address => 0x7e410000 function_address => 0x7e4299cb function_name => NotifyWinEvent |
SUCCESS | |||
| 2016-11-03 00:32:04.328977 | RegOpenKeyExW |
access => 0x00000001 base_handle => 0x80000001 key_handle => 0x00000094 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer regkey_r => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | RegQueryValueExW |
key_handle => 0x00000094 value => regkey_r => NoRun reg_type => 1244940 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun |
FAILURE | |||
| 2016-11-03 00:32:04.338977 | RegQueryValueExW |
key_handle => 0x00000094 value => regkey_r => NoDrives reg_type => 1244940 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives |
FAILURE | |||
| 2016-11-03 00:32:04.338977 | RegQueryValueExW |
key_handle => 0x00000094 value => regkey_r => RestrictRun reg_type => 1244940 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun |
FAILURE | |||
| 2016-11-03 00:32:04.338977 | RegQueryValueExW |
key_handle => 0x00000094 value => regkey_r => NoNetConnectDisconnect reg_type => 1244940 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetConnectDisconnect |
FAILURE | |||
| 2016-11-03 00:32:04.338977 | RegQueryValueExW |
key_handle => 0x00000094 value => regkey_r => NoRecentDocsHistory reg_type => 1244940 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory |
FAILURE | |||
| 2016-11-03 00:32:04.338977 | RegQueryValueExW |
key_handle => 0x00000094 value => regkey_r => NoClose reg_type => 1244940 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose |
FAILURE | |||
| 2016-11-03 00:32:04.338977 | RegCloseKey |
key_handle => 0x00000094 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | RegOpenKeyExW |
access => 0x00000001 base_handle => 0x80000001 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network regkey_r => Software\Microsoft\Windows\CurrentVersion\Policies\Network options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.338977 | RegOpenKeyExW |
access => 0x00000001 base_handle => 0x80000001 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32 regkey_r => Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.338977 | SHGetFolderPathW |
token_handle => 0x00000000 dirpath_r => C:\Program Files\Common Files flags => 0 owner_handle => 0x00000000 dirpath => C:\Program Files\Common Files folder => 43 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | GetFileVersionInfoSizeW |
filepath => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb7000 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | GetFileVersionInfoW |
buffer => è4 V S _ V E R S I O N _ I N F O ½ïþ ? H S t r i n g F i l e I n f o $ 0 4 0 9 0 4 e 4 V C o m p a n y N a m e A d o b e S y s t e m s I n c o r p o r a t e d j ! F i l e D e s c r i p t i o n A d o b e R e a d e r a n d A c r o b a t M a n a g e r 0 F i l e V e r s i o n 1 . 5 . 7 . 0 :
I n t e r n a l N a m e A d o b e A R M . e x e B
O r i g i n a l F i l e n a m e A d o b e A R M . e x e b ! P r o d u c t N a m e A d o b e R e a d e r a n d A c r o b a t M a n a g e r 4 P r o d u c t V e r s i o n 1 . 5 . 7 . 0 D V a r F i l e I n f o $ T r a n s l a t i o n äFE2X Ž filepath => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetDllHandle |
module_name => kernel32.dll module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c813100 function_name => GetUserDefaultUILanguage |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130c8 function_name => GetSystemDefaultUILanguage |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8154ec function_name => CreateActCtxW |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130ef function_name => ReleaseActCtx |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c80a6d4 function_name => ActivateActCtx |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c80a705 function_name => DeactivateActCtx |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | CreateActCtxW |
application_name => module_handle => 0x00400000 resource_name => |
FAILURE | |||
| 2016-11-03 00:32:04.338977 | NtClose |
handle => 0x00000098 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c82fd3c function_name => FindActCtxSectionStringW |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrLoadDll |
basename => AdobeARMENU module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARMENU.dll |
FAILURE | |||
| 2016-11-03 00:32:04.338977 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c82fd3c function_name => FindActCtxSectionStringW |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrLoadDll |
basename => AdobeARMENU module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARMENU.dll |
FAILURE | |||
| 2016-11-03 00:32:04.338977 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c82fd3c function_name => FindActCtxSectionStringW |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrLoadDll |
basename => AdobeARMENU module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARMENU.dll |
FAILURE | |||
| 2016-11-03 00:32:04.338977 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c82fd3c function_name => FindActCtxSectionStringW |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrLoadDll |
basename => AdobeARMENU module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARMENU.dll |
FAILURE | |||
| 2016-11-03 00:32:04.338977 | LdrGetDllHandle |
module_name => KERNEL32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.338977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c82fd3c function_name => FindActCtxSectionStringW |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | LdrLoadDll |
basename => AdobeARMLOC module_address => 0x00000000 flags => 0 module_name => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARMLOC.dll |
FAILURE | |||
| 2016-11-03 00:32:04.348977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.348977 | GetTempPathW |
dirpath => C:\DOCUME~1\ardi\LOCALS~1\Temp\ |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | NtOpenFile |
file_handle => 0x00000098 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | NtQueryInformationFile |
file_handle => 0x00000098 information_class => 9 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | NtClose |
handle => 0x00000098 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | NtCreateFile |
create_disposition => 3 file_handle => 0x00000098 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\AdobeARM.log desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\AdobeARM.log create_options => 96 status_info => 1 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | GetFileType |
file_handle => 0x00000098 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | SetFilePointer |
file_handle => 0x00000098 move_method => 1 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | SetFilePointer |
file_handle => 0x00000098 move_method => 2 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | SetFilePointer |
file_handle => 0x00000098 move_method => 1 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | SetFilePointer |
file_handle => 0x00000098 move_method => 0 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | SetFilePointer |
file_handle => 0x00000098 move_method => 2 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | SetFilePointer |
file_handle => 0x00000098 move_method => 1 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.348977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb8000 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | GetTimeZoneInformation | SUCCESS | ||||
| 2016-11-03 00:32:04.348977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | NtWriteFile |
buffer =>
[2016-11-03 10:12:04] Adobe ARM 1.5.7.0 logging started.
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.348977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.348977 | NtWriteFile |
buffer => [2016-11-03 10:12:04] Command Line: /PRODUCT:Reader /VERSION:9.0 /MODE:2
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | GetTempPathW |
dirpath => C:\DOCUME~1\ardi\LOCALS~1\Temp\ |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x0000009c |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x0000009c regkey => HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer regkey_r => Software\Policies\Microsoft\Windows\Installer options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegQueryValueExW |
key_handle => 0x0000009c value => éÂ|À‘|ÿÿÿÿ»‘|ÿþ€| µþ€| ¨ó @SÃ…c à <ó R˾c ó I Œþ Àšƒ| regkey_r => DisableUserInstalls reg_type => 1241832 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableUserInstalls |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer regkey_r => Software\Policies\Microsoft\Windows\Installer options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegQueryValueExW |
key_handle => 0x000000a0 value => Œ œ ·¼cÿÿÿÿhï Pï € Ø à @ñ |ï O·¼cÿÿÿÿ à € ß à èò regkey_r => Debug reg_type => 1240876 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\Debug |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x0000009c |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x0000009c |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x0000009c |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 regkey_r => Software\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegEnumValueW |
index => 0 key_handle => 0x000000a0 value => regkey_r => 68AB67CA7DA73301B7449A0500000010 reg_type => 1 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000\ç²ï™ˆç²|쀀 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a4 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a4 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegQueryValueExW |
key_handle => 0x000000a0 value => 9 regkey_r => VersionMajor reg_type => 4 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\VersionMajor |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegQueryValueExW |
key_handle => 0x000000a0 value => 5 regkey_r => VersionMinor reg_type => 4 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\VersionMinor |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegQueryValueExW |
key_handle => 0x000000a0 value => 9.5.0 regkey_r => DisplayVersion reg_type => 1 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\DisplayVersion |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegQueryValueExW |
key_handle => 0x000000a0 value => Adobe Reader 9.5.0 regkey_r => DisplayName reg_type => 1 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B7449A0500000010\InstallProperties\DisplayName |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\Installer regkey_r => SOFTWARE\Adobe\Acrobat Reader\9.0\Installer options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bb9000 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegQueryValueExW |
key_handle => 0x000000a0 value => C:\Program Files\Adobe\Reader 9.0\ regkey_r => Path reg_type => 1 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\Installer\Path |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000001 key_handle => 0x000000a0 regkey => HKEY_CURRENT_USER\SOFTWARE\Adobe\Acrobat Reader\9.0\Language\current regkey_r => SOFTWARE\Adobe\Acrobat Reader\9.0\Language\current options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegQueryValueExW |
key_handle => 0x000000a0 value => acrord32.dll regkey_r => reg_type => 1 regkey => HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\9.0\Language\current\(Default) |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegQueryValueExW |
key_handle => 0x000000a0 value => 1033 regkey_r => Language reg_type => 4 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010\Language |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 regkey_r => Software\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010 options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegQueryValueExW |
key_handle => 0x000000a0 value => 0 regkey_r => AuthorizedLUAApp reg_type => 4 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA7DA73301B7449A0500000010\AuthorizedLUAApp |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.358977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtWriteFile |
buffer => [2016-11-03 10:12:04] ProductCode: {AC76BA86-7AD7-1033-7B44-A95000000001}
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.358977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtWriteFile |
buffer => [2016-11-03 10:12:04] ProductName: Adobe Reader 9.5.0
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.358977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtWriteFile |
buffer => [2016-11-03 10:12:04] ProductVersion: 9.5.0
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.358977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtWriteFile |
buffer => [2016-11-03 10:12:04] ProductUACPatching: disabled
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 regkey_r => Software\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000 options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | RegEnumValueW |
index => 1 key_handle => 0x000000a0 value => regkey_r => reg_type => 1242440 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\66EDAE6A0000000084E4E7A854000000\(Default) |
FAILURE | |||
| 2016-11-03 00:32:04.358977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | FindResourceW |
module_handle => 0x00000000 name => #131 type => ARM_UI_INI |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | LoadResource |
module_handle => 0x00000000 resource_handle => 0x00484998 pointer => 0x00484df0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | SizeofResource |
module_handle => 0x00000000 resource_handle => 0x00484998 resource_size => 163994 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\ desired_access => 0x00100001 filepath_r => \??\C:\ open_options => 16417 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 9 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtCreateFile |
create_disposition => 5 file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x40100080 file_attributes => 128 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini create_options => 96 status_info => 2 share_access => 1 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtWriteFile |
buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ]
B G R = !2J@720=5 AJA AJ@2J@0. . .
C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . .
C H S = ck(WÞÂÂ¥c
g¡RhV. . .
C H T = ck(W#ÂÚ}óÂ:O
ghV. . .
C Z E = P Yi p o j o v á n à k  s e r v e r u &
D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . .
D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . .
E N U = C o n n e c t i n g t o s e r v e r . . .
E S P = C o n e c t a n d o a l s e r v i d o r . . .
E T I = S e r v e r i g a ü h e n d a m i n e . . .
E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . .
F R A = C o n n e x i o n a u s e r v e u r . . .
H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . .
H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . .
I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . .
J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . .
K O R = ļÃÃ… ðÅ°¬ É. . .
L T H = J u n g i a m a s i p r i e s e r v e r i o . . .
L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . .
N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . .
N O R = K o b l e r t i l s e r v e r . . .
P O L = Ac z e n i e z s e r w e r e m . . .
P T B = C o n e c t a n d o a o s e r v i d o r . . .
R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . .
R U S = >4:;NG5=85 : A5@25@C&
S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . .
S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . .
S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . .
S V E = A n s l u t e r t i l l s e r v e r . . .
T U R = S u n u c u y a b a l a n 1l 1y o r . . .
U K R = V4:;NG5==O 4> A5@25@0. . .
[ I D S _ A C T I O N _ E X T R A C T I N G ]
B G R = 72;8G0=5 =0 D09;>25. . .
C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . .
C H S = ck(WÃcÖS‡eöN. . .
C H T = ck(W÷dÖS”jHh. . .
C Z E = E x t r a h o v á n às o u b o r o. . .
D A N = U d t r æ k k e r f i l e r . . .
D E U = D a t e i e n w e r d e n e x t r a h i e r t . . .
E N U = E x t r a c t i n g f i l e s . . .
E S P = E x t r a y e n d o a r c h i v o s . . .
E T I = F a i l i d e e k s t r a k t i m i n e . . .
E U Q = F i t x a t e g i a k a t e r a t z e n . . .
F R A = E x t r a c t i o n d e s f i c h i e r s . . .
H R V = I z d v a j a n j e d a t o t e k a . . .
H U N = F á j l o k k i b o n t á s a . . .
I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . .
J P N = Õ0¡0¤0ë0’0½búQ-N. . .
K O R = Ó|Ç UŕÃDÇ xԔ² É. . .
L T H = I at r a u k i a m o s r i n k m e n o s . . .
L V I = I z g ks t f a i l u s . . .
N L D = B e s t a n d e n u i t p a k k e n . . .
N O R = P a k k e r u t f i l e r . . .
P O L = W y d z i e l a n i e p l i k ó w . . .
P T B = E x t r a i n d o a r q u i v o s . . .
R U M = S e e x t r a g f i _i e r e l e . . .
R U S = 72;5G5=85 D09;>2&
S K Y = E x t r a h u j ú s a s ú b o r y . . .
S L V = E k s t r a h i r a n j e d a t o t e k . . .
S U O = P u r e t a a n t i e d o s t o j a . . .
S V E = E x t r a h e r a r f i l e r . . .
T U R = D o s y a l a r a y 1k l a n 1y o r . . .
U K R = 8;CG5==O D09;V2. . .
[ I D S _ A C T I O N _ I N S T A L L I N G ]
B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . .
C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . .
C H S = ck(W‰[ňôf°e ÿ÷‹
zI{Ã QR file_handle => 0x000000a0 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bba000 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bbb000 |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | GetFileAttributesW |
file_attributes => 32 filepath_r => C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini |
SUCCESS | |||
| 2016-11-03 00:32:04.358977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bbc000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x0018e000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.369977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.379977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.389977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.399977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtOpenFile |
file_handle => 0x000000a0 filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini desired_access => 0x80100000 filepath_r => \??\C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini open_options => 96 status_info => 1 share_access => 7 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtQueryInformationFile |
file_handle => 0x000000a0 information_class => 5 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 1216512 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 167936 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtReadFile |
file_handle => 0x000000a0 buffer => ÿþ[ I D S _ A C T I O N _ C O N N E C T I N G ] B G R = !2J@720=5 AJA AJ@2J@0. . . C A T = S ' e s t à c o n n e c t a n t a m b e l s e r v i d o r . . . C H S = ck(WÞÂÂ¥c g¡RhV. . . C H T = ck(W#ÂÚ}óÂ:O ghV. . . C Z E = P Yi p o j o v á n à k  s e r v e r u & D A N = O p r e t t e r f o r b i n d e l s e t i l s e r v e r . . . D E U = S e r v e r v e r b i n d u n g w i r d h e r g e s t e l l t . . . E N U = C o n n e c t i n g t o s e r v e r . . . E S P = C o n e c t a n d o a l s e r v i d o r . . . E T I = S e r v e r i g a ü h e n d a m i n e . . . E U Q = Z e r b i t z a r i r a k o n e k t a t z e n . . . F R A = C o n n e x i o n a u s e r v e u r . . . H R V = P o v e z i v a n j e s p o s l u ~i t e l j e m . . . H U N = K a p c s o l ó d á s a k i s z o l g á l ó h o z . . . I T A = C o n n e s s i o n e a l s e r v e r i n c o r s o . . . J P N = µ0ü0Ã0ü0k0Â¥cš}-N. . . K O R = ļÃÃ… ðÅ°¬ É. . . L T H = J u n g i a m a s i p r i e s e r v e r i o . . . L V I = V e i d o s a v i e n o j u m u a r s e r v e r i . . . N L D = V e r b i n d i n g m a k e n m e t s e r v e r . . . N O R = K o b l e r t i l s e r v e r . . . P O L = Ac z e n i e z s e r w e r e m . . . P T B = C o n e c t a n d o a o s e r v i d o r . . . R U M = S e r e a l i z e a z c o n e x i u n e a l a s e r v e r . . . R U S = >4:;NG5=85 : A5@25@C& S K Y = P r e b i e h a p r i p á j a n i e n a s e r v e r . . . S L V = V z p o s t a v l j a n j e p o v e z a v e s s t r e ~n i k o m . . . S U O = M u o d o s t e t a a n y h t e y t t ä p a l v e l i m e e n . . . S V E = A n s l u t e r t i l l s e r v e r . . . T U R = S u n u c u y a b a l a n 1l 1y o r . . . U K R = V4:;NG5==O 4> A5@25@0. . . [ I D S _ A C T I O N _ E X T R A C T I N G ] B G R = 72;8G0=5 =0 D09;>25. . . C A T = S ' e s t a n e x t r a i e n t e l s f i t x e r s . . . C H S = ck(WÃcÖS‡eöN. . . C H T = ck(W÷dÖS”jHh. . . C Z E = E x t r a h o v á n à s o u b o r o. . . D A N = U d t r æ k k e r f i l e r . . . D E U = D a t e i e n w e r d e n e x t r a h i e r t . . . E N U = E x t r a c t i n g f i l e s . . . E S P = E x t r a y e n d o a r c h i v o s . . . E T I = F a i l i d e e k s t r a k t i m i n e . . . E U Q = F i t x a t e g i a k a t e r a t z e n . . . F R A = E x t r a c t i o n d e s f i c h i e r s . . . H R V = I z d v a j a n j e d a t o t e k a . . . H U N = F á j l o k k i b o n t á s a . . . I T A = E s t r a z i o n e d e i f i l e i n c o r s o . . . J P N = Õ0¡0¤0ë0Â’0½búQ-N. . . K O R = Ó|Ç UŕÃDÇ xԔ² É. . . L T H = I at r a u k i a m o s r i n k m e n o s . . . L V I = I z g ks t f a i l u s . . . N L D = B e s t a n d e n u i t p a k k e n . . . N O R = P a k k e r u t f i l e r . . . P O L = W y d z i e l a n i e p l i k ó w . . . P T B = E x t r a i n d o a r q u i v o s . . . R U M = S e e x t r a g f i _i e r e l e . . . R U S = 72;5G5=85 D09;>2& S K Y = E x t r a h u j ú s a s ú b o r y . . . S L V = E k s t r a h i r a n j e d a t o t e k . . . S U O = P u r e t a a n t i e d o s t o j a . . . S V E = E x t r a h e r a r f i l e r . . . T U R = D o s y a l a r a y 1k l a n 1y o r . . . U K R = 8;CG5==O D09;V2. . . [ I D S _ A C T I O N _ I N S T A L L I N G ] B G R = 7G0:09B5 =O:>;:> <8=CB8, 4>:0B> A5 8=AB0;8@0 0:BC0;870F8OB0. . . C A T = E s p e r e u u n a e s t o n a m e n t r e s ' i n s t a l · l a l ' a c t u a l i t z a c i ó . . . C H S = ck(W‰[ňôf°e ÿ÷‹ zI{à QR length => 163994 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 1216512 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtClose |
handle => 0x000000a4 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtClose |
handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | RegOpenKeyExW |
access => 0x000f003f base_handle => 0x80000001 key_handle => 0x000000a0 regkey => HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | RegDeleteValueW |
key_handle => 0x000000a0 regkey_r => iNotify regkey => HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\iNotify |
FAILURE | |||
| 2016-11-03 00:32:04.409977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.409977 | NtCreateFile |
create_disposition => 1 file_handle => 0x00000000 filepath => \\?\pipe\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E009524054672thsnYaVieBoda desired_access => 0x40100080 file_attributes => 0 filepath_r => \??\pipe\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E009524054672thsnYaVieBoda create_options => 96 status_info => 4294967295 share_access => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.409977 | NtQuerySystemInformation |
information_class => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\PagedBuffers regkey_r => Software\Microsoft\Rpc\PagedBuffers options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.409977 | RegOpenKeyExA |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000a0 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc regkey_r => Software\Microsoft\Rpc options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | RegQueryValueExA |
key_handle => 0x000000a0 value => ó regkey_r => MaxRpcSize reg_type => 160 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\MaxRpcSize |
FAILURE | |||
| 2016-11-03 00:32:04.409977 | RegCloseKey |
key_handle => 0x000000a0 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdobeARM.exe\RpcThreadPoolThrottle regkey_r => Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdobeARM.exe\RpcThreadPoolThrottle options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.409977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc regkey_r => Software\Policies\Microsoft\Windows NT\Rpc options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.409977 | GlobalMemoryStatusEx | SUCCESS | ||||
| 2016-11-03 00:32:04.409977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x0018f000 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | LdrLoadDll |
basename => rpcrt4 module_address => 0x77e70000 flags => 0 module_name => rpcrt4.dll |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtDuplicateObject |
handle_attributes => 0 source_process_identifier => 1488 source_handle => 0xfffffffe target_process_identifier => 1488 desired_access => 0x00000000 target_process_handle => 0xffffffff target_handle => 0x000000b0 source_process_handle => 0xffffffff options => 2 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | GetComputerNameW |
computer_name => ARDI-658FEFD2A5 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtDuplicateObject |
handle_attributes => 0 source_process_identifier => 1488 source_handle => 0x000000b4 target_process_identifier => 1488 desired_access => 0x00000000 target_process_handle => 0xffffffff target_handle => 0x000000bc source_process_handle => 0xffffffff options => 2 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000c4 filepath => \\?\PIPE\lsarpc desired_access => 0xc0100080 file_attributes => 0 filepath_r => \??\PIPE\lsarpc create_options => 64 status_info => 1 share_access => 3 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtSetInformationFile |
file_handle => 0x000000c4 information_class => 23 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtSetInformationFile |
file_handle => 0x000000c4 information_class => 30 |
SUCCESS | |||
| 2016-11-03 00:32:04.409977 | NtWriteFile |
buffer => H ¸¸ xW44ëï #Eg‰« ]ˆŠë ɟè +H` file_handle => 0x000000c4 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00190000 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtReadFile |
file_handle => 0x000000c4 buffer => D ¸¸ \PIPE\lsass ]ˆŠë ɟè +H` length => 1024 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtClose |
handle => 0x000000c0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtClose |
handle => 0x000000c4 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c9133df function_name => EncodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c913405 function_name => DecodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | CreateThread |
thread_identifier => 1432 function_address => 0x0043547a flags => 0 parameter => 0x00bbbdb0 stack_size => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000c8 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\AdobeViewer regkey_r => SOFTWARE\Adobe\Acrobat Reader\9.0\AdobeViewer options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegQueryValueExW |
key_handle => 0x000000c8 value => 1 regkey_r => EULA reg_type => 4 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Acrobat Reader\9.0\AdobeViewer\EULA |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegCloseKey |
key_handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000c8 regkey => HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer regkey_r => Software\Policies\Microsoft\Windows\Installer options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegQueryValueExW |
key_handle => 0x000000c8 value => regkey_r => DisablePatch reg_type => 1244768 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisablePatch |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | RegCloseKey |
key_handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000c8 regkey => HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer regkey_r => Software\Policies\Microsoft\Windows\Installer options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegQueryValueExW |
key_handle => 0x000000c8 value => regkey_r => DisableLUAPatching reg_type => 1244768 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableLUAPatching |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | RegCloseKey |
key_handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtClose |
handle => 0x000000cc |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtClose |
handle => 0x000000cc |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.419977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00dd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtWriteFile |
buffer => [2016-11-03 10:12:04] Admin User, IsElevated returns 1
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x000000cc regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown regkey_r => SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockdown options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegQueryValueExW |
key_handle => 0x000000cc value => iÃf regkey_r => bUpdater reg_type => 1244748 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\9.0\FeatureLockDown\bUpdater |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | RegCloseKey |
key_handle => 0x000000cc |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.419977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00dd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtWriteFile |
buffer => [2016-11-03 10:12:04] Found CommandLine preference AUTO_DOWNLOAD.
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000001 key_handle => 0x000000cc regkey => HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegQueryValueExW |
key_handle => 0x000000cc value => Ÿ»Ÿ»DLG_ERR IDS_MSGBOX_ERR_TITLE IDS_PROXY_AUTH_TITLE IDS_PROXY_AUTH_USERNAME IDS_PROXY_AUTH_PASSWORD IDS_PROXY_AUTH_CHECKBOX IDS_TITLE_CHECKING IDS_TITLE_COMPLETE_SUCCESS IDS_TITLE_INSTALLING_UPDATES IDS_TITLE_NOT_UPDATED IDS_TITLE_READY_TO_DOWNLOAD IDS_TITLECBEAλλO_UPGRADE IDS_TITLE_UPGRADE_INSTALLATION IDS_INFO_UPGRADE IDS_INFO_UPGRADE_X IDS_WHATS_NEW_URL IDS_CHECK_NOTIFY IDS_BTN_REMIND_ME_LATER IDS_BTN_EXIT regkey_r => tLastT_Reader reg_type => 1 regkey => HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\tLastT_Reader |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00bbd000 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegQueryValueExW |
key_handle => 0x000000cc value => 9524054672thsnY01000000D08C9DDF0115D1118C7A00C04FC297EB010000003CA587FD8788D9499C6A2997DBC8F641000000002800000045006E0063007200790070007400650064002000620079002000410064006F00620065002E00000003660000A8000000100000008DE3C07C54D0679C9D471ED5707CF7070000000004800000A00000001000000003CE99FC971236D8BEB9D2DC6E4687CB1800000053AFB594D4FC3F84A947CEA58ABDFE166BECDDFFA6712035140000007A73572F02735C97BF61A419014E5915045D83EA regkey_r => tLastT_Reader reg_type => 1 regkey => HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\tLastT_Reader |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegCloseKey |
key_handle => 0x000000cc |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | CryptUnprotectData |
description => Encrypted by Adobe. buffer => 1 4 7 8 1 0 2 3 7 3 flags => 1 entropy => t h s n |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.419977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.419977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00dd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00dd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00dd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtWriteFile |
buffer => [2016-11-03 10:12:04] Time elapsed is less than time limit - returning 0
[2016-11-03 10:12:04] Error Code: 120300
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000 regkey_r => Software\Classes\Installer\UpgradeCodes\68AB67CA000000007716E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000 regkey_r => Software\Classes\Installer\UpgradeCodes\68AB67CA000000007706E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000 regkey_r => Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1645522239-1935655697-854245398-1003\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000003 key_handle => 0x00000000 regkey => HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000 regkey_r => S-1-5-21-1645522239-1935655697-854245398-1003\Software\Microsoft\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000 regkey_r => Software\Classes\Installer\UpgradeCodes\68AB67CA00000000ABE7E7A854000000 options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.419977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.419977 | NtCreateFile |
create_disposition => 1 file_handle => 0x000000c8 filepath => \\?\pipe\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E009524054672thsnYaVieBoda desired_access => 0x40100080 file_attributes => 0 filepath_r => \??\pipe\32B6B37A-4A7D-4e00-95F2-6F0BF3DE3E009524054672thsnYaVieBoda create_options => 96 status_info => 1 share_access => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtWriteFile |
buffer => É file_handle => 0x000000c8 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.419977 | NtClose |
handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:32:04.429977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.429977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c913405 function_name => DecodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.429977 | LdrGetDllHandle |
module_name => KERNEL32.DLL module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.429977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c913405 function_name => DecodePointer |
SUCCESS | |||
| 2016-11-03 00:32:04.429977 | NtSetInformationFile |
file_handle => 0x000000c4 information_class => 23 |
SUCCESS | |||
| 2016-11-03 00:32:04.429977 | NtDelayExecution |
skipped => 0 milliseconds => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.429977 | GetFileAttributesW |
file_attributes => 32 filepath_r => C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini |
SUCCESS | |||
| 2016-11-03 00:32:04.429977 | SetFileAttributesW |
file_attributes => 128 filepath_r => C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | DeleteFileW |
filepath_r => C:\DOCUME~1\ardi\LOCALS~1\Temp\ArmUI.ini filepath => C:\Documents and Settings\ardi\Local Settings\Temp\ArmUI.ini |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | GetFileAttributesW |
file_attributes => 4294967295 filepath_r => filepath => |
FAILURE | |||
| 2016-11-03 00:32:04.439977 | GetFileAttributesW |
file_attributes => 4294967295 filepath_r => filepath => |
FAILURE | |||
| 2016-11-03 00:32:04.439977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000002 key_handle => 0x00000000 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.439977 | RegOpenKeyExW |
access => 0x00020019 base_handle => 0x80000001 key_handle => 0x000000c8 regkey => HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | RegQueryValueExW |
key_handle => 0x000000c8 value => Ÿ»DLG_ERR IDS_MSGBOX_ERR_TITLE IDS_PROXY_AUTH_TITLE IDS_PROXY_AUTH_USERNAME IDS_PROXY_AUTH_PASSWORD IDS_PROXY_AUTH_CHECKBOX IDS_TITLE_CHECKING IDS_TITLE_COMPLETE_SUCCESS IDS_TITLE_INSTALLING_UPDATES IDS_TITLE_NOT_UPDATED IDS_TITLE_READY_TO_DOWNLOAD IDS_TITLEBǵ 耘»Ï»ǻ è³í¾ IDǸ 안»è³í¾á”ᇑŒRǽ 취»è³í¾á”ᇑ窌쀀ì‰î®— ꔼﶇ‡SÇ ì¾€Â» Cleanup... UǪ 춰»è³í¾á”ᇑ窌쀀ì‰î®— ꔼﶇ袇䧙檜霩죛䇶 (I Æ“ ìŸÂ» IsLongTimeNoUpdates... Æš Conn regkey_r => tLastT_Reader reg_type => 1 regkey => HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\tLastT_Reader |
FAILURE | |||
| 2016-11-03 00:32:04.439977 | RegQueryValueExW |
key_handle => 0x000000c8 value => 9524054672thsnY01000000D08C9DDF0115D1118C7A00C04FC297EB010000003CA587FD8788D9499C6A2997DBC8F641000000002800000045006E0063007200790070007400650064002000620079002000410064006F00620065002E00000003660000A8000000100000008DE3C07C54D0679C9D471ED5707CF7070000000004800000A00000001000000003CE99FC971236D8BEB9D2DC6E4687CB1800000053AFB594D4FC3F84A947CEA58ABDFE166BECDDFFA6712035140000007A73572F02735C97BF61A419014E5915045D83EA regkey_r => tLastT_Reader reg_type => 1 regkey => HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\tLastT_Reader |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | RegCloseKey |
key_handle => 0x000000c8 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | CryptUnprotectData |
description => Encrypted by Adobe. buffer => 1 4 7 8 1 0 2 3 7 3 flags => 1 entropy => t h s n |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.439977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.439977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtWriteFile |
buffer => [2016-11-03 10:12:04] ARM returns ERROR_SUCCESS
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | GetSystemTimeAsFileTime | SUCCESS | ||||
| 2016-11-03 00:32:04.439977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 65536 protection => 4 process_handle => 0xffffffff allocation_type => 8192 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtAllocateVirtualMemory |
process_identifier => 1488 region_size => 4096 protection => 4 process_handle => 0xffffffff allocation_type => 4096 base_address => 0x00cd0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00cd0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtWriteFile |
buffer => [2016-11-03 10:12:04] Adobe ARM 1.5.7.0 logging finished.
file_handle => 0x00000098 offset => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | UnhookWindowsHookEx |
hook_handle => 0x000f0091 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x00000098 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x000000c4 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x000000c0 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | RegOpenKeyExW |
access => 0x000f003f base_handle => 0x80000001 key_handle => 0x000000c0 regkey => HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe ARM\1.0\ARM regkey_r => SOFTWARE\Adobe\Adobe ARM\1.0\ARM options => 0 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | RegDeleteValueW |
key_handle => 0x000000c0 regkey_r => iNotify regkey => HKEY_CURRENT_USER\Software\Adobe\Adobe ARM\1.0\ARM\iNotify |
FAILURE | |||
| 2016-11-03 00:32:04.439977 | RegCloseKey |
key_handle => 0x000000c0 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtUnmapViewOfSection |
process_identifier => 1488 region_size => 8192 process_handle => 0xffffffff base_address => 0x00cc0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | LdrGetDllHandle |
module_name => mscoree.dll module_address => 0x00000000 |
FAILURE | |||
| 2016-11-03 00:32:04.439977 | LdrGetDllHandle |
module_name => mscoree.dll module_address => 0x00000000 |
FAILURE | |||
| 2016-11-03 00:32:04.439977 | NtTerminateProcess |
status_code => 0x00000000 process_identifier => 0 process_handle => 0x00000000 |
FAILURE | |||
| 2016-11-03 00:32:04.439977 | NtTerminateProcess |
status_code => 0x00000000 process_identifier => 0 process_handle => 0x00000000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtUnmapViewOfSection |
process_identifier => 1488 region_size => 327680 process_handle => 0xffffffff base_address => 0x00c40000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x00000090 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | GetSystemMetrics |
index => 31 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | LdrUnloadDll |
library => uxtheme module_address => 0x5ad70000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x0000008c |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x00000080 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | LdrGetDllHandle |
module_name => Kernel32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130ef function_name => ReleaseActCtx |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtUnmapViewOfSection |
process_identifier => 1488 region_size => 8192 process_handle => 0xffffffff base_address => 0x00a60000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x00000068 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x00000060 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x0000005c |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x00000058 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x003f0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x003e0000 size => 65536 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x00000094 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | LdrGetDllHandle |
module_name => Kernel32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130ef function_name => ReleaseActCtx |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtUnmapViewOfSection |
process_identifier => 1488 region_size => 8192 process_handle => 0xffffffff base_address => 0x003c0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x00000054 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | LdrGetDllHandle |
module_name => Kernel32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130ef function_name => ReleaseActCtx |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtUnmapViewOfSection |
process_identifier => 1488 region_size => 8192 process_handle => 0xffffffff base_address => 0x003d0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | RegCloseKey |
key_handle => 0x00000050 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | LdrGetDllHandle |
module_name => Kernel32 module_address => 0x7c800000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | LdrGetProcedureAddress |
ordinal => 0 module => kernel32 module_address => 0x7c800000 function_address => 0x7c8130ef function_name => ReleaseActCtx |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtUnmapViewOfSection |
process_identifier => 1488 region_size => 8192 process_handle => 0xffffffff base_address => 0x003b0000 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x0000004c |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x00000044 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | SetUnhandledExceptionFilter | SUCCESS | ||||
| 2016-11-03 00:32:04.439977 | NtOpenKey |
key_handle => 0x00000044 desired_access => 0x00020019 regkey => HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtQueryValueKey |
key_handle => 0x00000044 key_name => value => reg_type => 0 information_class => 2 regkey => HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles |
FAILURE | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x00000044 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x00000040 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtFreeVirtualMemory |
free_type => 32768 process_identifier => 1488 process_handle => 0xffffffff base_address => 0x00000000 size => 0 |
FAILURE | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x00000010 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtClose |
handle => 0x00000020 |
SUCCESS | |||
| 2016-11-03 00:32:04.439977 | NtTerminateProcess |
status_code => 0x00000000 process_identifier => 1488 process_handle => 0xffffffff |
FAILURE |